Keys and apps, kept apart
API keys serve your own integrations; OAuth apps serve anyone connecting on someone else's behalf. They are different things with different risks, so they are managed separately.
Webhooks, with what actually happened
Webhooks are configured per event, and the request log shows what was sent and what came back. When an integration "does not work", the answer is in the log rather than in a guess.
Playground and specification
You can try calls straight from the portal, before writing a line of code. The OpenAPI specification is published, so you can generate your own client if none of our SDKs suits you.
Documentation and migration notes sit next to the specification — a breaking change is announced there, not discovered in production.
SDKs and a CLI
There are SDKs for TypeScript, PHP, Python, Go, Java and .NET, plus a CLI. This is not a list of intentions: each is a package in this repository, built from the same specification.
Signatures and validations
The trust section exposes signature and validation checking — useful when your integration has to prove, rather than assume, that a document it received is authentic.
Worth knowing
An API is judged by what happens when something goes wrong. That is why the request log and the migration notes sit in the portal alongside the documentation: they are what you open when you already have a problem.