Developer Tools

API keys and webhooks let workspace owners integrate LaunchKit Pro with external systems. Raw secrets are shown once at creation.

API keys

Method	Path
GET	/workspaces/:workspaceId/api-keys
POST	/workspaces/:workspaceId/api-keys
PATCH	/workspaces/:workspaceId/api-keys/:apiKeyId
DELETE	/workspaces/:workspaceId/api-keys/:apiKeyId

Create:

curl -s -X POST http://localhost:4000/workspaces/<workspaceId>/api-keys \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Local Dev Key",
    "scopes": ["workspace:read", "files:read"]
  }' | jq

Response includes rawKey once. Only hash + prefix are stored in database.

Use API keys with:

curl -s http://localhost:4000/public-api/me \
  -H "X-API-Key: lk_..." | jq

Authorization: Bearer lk_... is also accepted. The proof endpoints are:

Method	Path	Auth
GET	/public-api/me	API key
GET	/public-api/workspace	API key

Default scopes include simple read, write, and webhooks:send plus granular starter scopes. Extend these in src/modules/developer/constants/api-key-scopes.constants.ts.

Plan limits (reference):

Plan	API keys
Lite	Not allowed
Pro	Up to 5
Enterprise	Up to 50

Webhooks

Method	Path
GET	/workspaces/:workspaceId/webhooks
POST	/workspaces/:workspaceId/webhooks
PATCH	/workspaces/:workspaceId/webhooks/:webhookId
DELETE	/workspaces/:workspaceId/webhooks/:webhookId
POST	/workspaces/:workspaceId/webhooks/:webhookId/test

Create:

curl -s -X POST http://localhost:4000/workspaces/<workspaceId>/webhooks \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CRM Webhook",
    "url": "https://example.com/webhook",
    "events": ["billing.updated"]
  }' | jq

Signing secret (whsec_*) returned once. New secrets are encrypted at rest for outbound signing and are never returned again.

Test webhook payload:

{
  "event": "webhook.test",
  "createdAt": "2026-06-06T00:00:00.000Z",
  "workspaceId": "...",
  "data": {
    "message": "This is a test webhook from LaunchKit Pro."
  }
}

Outbound requests are HTTP POST JSON with:

• Content-Type: application/json
• User-Agent: WEBHOOK_USER_AGENT
• X-LaunchKit-Event
• X-LaunchKit-Delivery
• X-LaunchKit-Timestamp
• X-LaunchKit-Signature

Signature format: HMAC SHA-256 over timestamp + "." + rawJsonBody using the webhook signing secret.

Node.js verification example:

import { createHmac, timingSafeEqual } from 'crypto';

function verifyLaunchKitWebhook({ secret, timestamp, body, signature }) {
  const expected = createHmac('sha256', secret)
    .update(`${timestamp}.${body}`)
    .digest('hex');
  return timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Webhook deliveries

curl -s "http://localhost:4000/workspaces/<workspaceId>/webhook-deliveries?page=1&limit=20" \
  -H "Authorization: Bearer <accessToken>" | jq

Delivery logs track event, status, attempts, safe request headers, payload, status code, response preview, duration, next retry time, and errors. Response bodies are truncated. Signing secrets are never stored in delivery logs.

Retry failed deliveries:

curl -s -X POST http://localhost:4000/workspaces/<workspaceId>/webhook-deliveries/<deliveryId>/retry \
  -H "Authorization: Bearer <accessToken>" | jq

Security practices

• Store raw keys/secrets in your password manager immediately after create
• Never commit keys to git or client-side code
• Revoke compromised keys promptly
• Use minimal scopes per key
• Use HTTPS webhook endpoints in production
• file://, localhost, loopback, and internal hostnames are rejected by URL validation
• If WEBHOOK_DELIVERY_ENABLED=false, no external calls are made and deliveries are recorded as disabled
• If queues are disabled, test delivery still runs safely without Redis (direct delivery path)
• Set WEBHOOK_QUEUE_ENABLED=true when QUEUES_ENABLED=true and Redis is ready to enqueue deliver_webhook jobs; retries use WEBHOOK_MAX_RETRIES and WEBHOOK_RETRY_BACKOFF_SECONDS
• Demo delivery can be disabled with WEBHOOK_DEMO_DELIVERY_DISABLED=true

Frontend

• /dashboard/developer/api-keys
• /dashboard/developer/webhooks
• /dashboard/developer/webhook-deliveries

Related

• API Documentation
• Demo Mode — blocks key/webhook mutations for demo users