Platform
Developer API & Webhooks
Connect websites and services using server-scoped credentials and signed event deliveries.
Getting started
Choose scopes
Create a named read-only API key with only the server.read, modules.read, or analytics.read scopes the integration needs.
Set a policy
Choose an expiration period and a per-key rate limit from 10 to 600 requests per minute, then copy the key once.
Call the API
Send the key as `Authorization: Bearer nc_live_...` to /api/v1/server, /api/v1/modules, or /api/v1/analytics.
Debug responses
Use the response _meta request ID, API version, and response time plus the dashboard request activity stream.
Create a webhook
Enter a public HTTPS endpoint, select events, copy the signing secret once, and run Test.
Verify delivery
Compute HMAC-SHA256 over the raw request body and compare it to X-NightCrew-Signature before processing JSON.
Operate access
Rotate or revoke API keys; test, pause, enable, rotate the signing secret, or delete webhooks; review sanitized delivery receipts and failures.
Settings reference
Use this reference when you need to check what a setting does.
Safe identifier shown after the one-time secret disappears.
Explicit server.read, modules.read, and analytics.read permissions.
Date after which authentication returns API key expired.
Maximum successful calls per rolling minute for one key.
Diagnostic identifier returned in _meta and shown in activity.
HMAC-SHA256 secret shown once for one webhook.
Sanitized event, status, HTTP code, and response time without payload or IP retention.
How it works
Here’s what happens once you’ve finished setup.
- 1Client
Sends the API key only from a trusted server environment.
- 2NightCrew
Hashes authentication, checks scope, expiration, and rate limit, then returns v1 data with _meta.
- 3Event
NightCrew signs the raw webhook body and sends delivery headers.
- 4Receiver
Verifies the signature before parsing or acting on the payload.
Example
Create a 90-day key with server.read and analytics.read, use a conservative rate limit, store it in the host secret manager, and rotate it before expiration.
Tips
Store secrets in environment variables or a secret manager, never client-side JavaScript.
Things to know
Never place API keys or signing secrets in browser JavaScript, public repositories, screenshots, or support messages.
Troubleshooting
Create or rotate the credential and update the trusted server secret.
Create a least-privilege key containing the endpoint's required scope.
Honor Retry-After and reduce polling.
Ten consecutive failures pause it; correct the endpoint, enable it, and run Test.