Connect API Keys and Signed Webhooks

Integrations provides Webhook endpoints, Delivery logs, and API keys. API keys can be limited to appointment and customer scopes, while webhook requests are signed and retried through a queue.

Open the feature

Go to Yo Booking > Settings > Integrations.

Before you start

• Define the receiving system, minimum scopes, endpoint ownership, and secret-rotation process.
• Use HTTPS endpoints and a staging receiver.

Recommended workflow

1. Create an API key with only the required read or write scopes and copy it once to a secret manager.
2. Create a webhook endpoint and choose only required booking events.
3. Verify the receiver validates the webhook signature.
4. Trigger a staging event and review Delivery logs.
5. Resolve the cause before retrying a failed delivery.
6. Rotate or revoke unused keys and endpoint secrets.

What success looks like

• Authorized REST requests work only within assigned scopes.
• Signed webhook events arrive once or are handled idempotently across retries.

Important notes

• API keys and webhook secrets are credentials; never place them in public Docs, tickets, or screenshots.
• Integration payloads can transmit personal data to the configured destination; document that destination in the privacy policy.

Release and support resources

• View the product page
• Install the stable free version from WordPress.org
• Review the official release notes