Let's Get QuotedSign in to Dashboard
← User Manual

Chapter 9 · Guide 9.8

Connect custom tools with the Developer API and Webhooks

Generate scoped REST API tokens, subscribe to real-time webhook event feeds, and import OpenAPI 3.1 definitions.

7 minute readVerified August 29, 2026
Owner

At a glance

Use this guide when

You are connecting external business applications, CRMs, Zapier, Make, or custom scripts to your Let’s Get Quoted workspace.

Best practice

Use minimum scoped tokens (e.g. read-only) for data exports and always verify webhook HMAC SHA-256 signatures on your server.

Watch for

Exposing secret API tokens or webhook signing secrets in client-side code will compromise workspace data security.

01

Create and manage scoped API tokens

  1. Go to Settings → Developer API & Webhooks.
  2. Click "Generate New Token", enter a descriptive label (e.g. "Zapier Lead Sync"), and select required role scopes (leads:read, leads:write, webhooks:manage, events:read).
  3. Copy your secret token (format: lgq_live_...) immediately upon generation. For security, secret tokens are hashed and never shown again.
  4. Pass tokens in external HTTP requests using standard authorization headers: Authorization: Bearer lgq_live_...
02

Set up real-time Webhook subscriptions

  • Event Feeds: Subscribe to live events including lead.created, quote.signed, invoice.paid, and job.completed.
  • HTTPS & SSRF Protection: Webhook destinations must use secure HTTPS URLs; localhost and private intranet IP addresses are rejected by edge guards.
  • HMAC SHA-256 Verification: Every outgoing webhook delivery includes an x-lgq-signature header calculated using your unique endpoint signing secret and a timestamp to prevent replay attacks.
03

Explore OpenAPI 3.1 schema and dead-letter retry

Access the interactive OpenAPI 3.1 JSON definition at /api/v1/openapi.json to import into Postman, Insomnia, or custom SDK generators. If your endpoint is temporarily down, the system retries with exponential backoff and provides a manual 1-click retry button in the Webhook Deliveries audit table.

Completion check

Confirm before moving on

Use these checks to make sure the dashboard and the real-world workflow agree.

  • API tokens are generated with least-privilege role scopes and copied securely.
  • Webhook HTTPS endpoints respond with 2xx status and verify HMAC signatures.
  • Failed webhook deliveries can be inspected and retried from the dashboard.

Troubleshooting

When the workflow doesn’t look right

Webhook deliveries fail with 5xx status or timeout.

Ensure your server responds with a 2xx HTTP status within 10 seconds. Check endpoint SSL certificates and click "Retry Delivery" in the deliveries table.

API returns 401 Unauthorized.

Verify the token has not been revoked and that the Authorization: Bearer header is formatted correctly without extra quotes.

Keep going

Related guides

Export data and connect external business appsExport client, invoice, and job CSV reports, and connect QuickBooks or calendar sync tools.Manage office access, sign-in, and account securityInvite office teammates by email, manage secure sign-in methods, and remove access cleanly.Find help, search documentation, and contact supportSearch user guides, diagnose common issues with troubleshooting tools, and open support tickets.
Connect custom tools with the Developer API and Webhooks | Dashboard User Manual · Let's Get Quoted