Skip to main content

​
API authentication

Airlead uses resource-specific webhook secrets. There is no workspace-wide public API key for the endpoints in this reference.

​
Send the secret

Use either supported form:
or:

​
Select the correct credential

  • Lead ingest: use the secret configured for that source. It is required when the source has one configured.
  • Buyer lifecycle callbacks: use the webhook secret of the buyer associated with the transaction.
  • Supplier cancellation confirmation: use the supplier credential agreed for that lead flow.
Do not interchange source and buyer secrets.

​
Security requirements

  • Use TLS.
  • Store secrets in a secret manager or environment variable.
  • Never include secrets in URLs, client-side code, logs, or support messages.
  • Use separate credentials per environment.
  • Rotate exposed credentials before sending more traffic.