API Keys
Create scoped API keys, project access, webhook endpoints, and delivery diagnostics from workspace integrations.
Workspace admins create Public API keys and webhook endpoints from workspace integrations.
Use API keys for server-side automation, AI agents, no-code workflows, and external adapters. Do not put API keys in browser code.
Create an API key
Open workspace integrations
Open your workspace settings and go to the integrations area for API keys and webhooks.
Name the key
Use a clear name such as Zapier production, AI triage agent, or GitHub adapter.
Choose project access
Select All projects or a specific project.
Choose scopes
Select the smallest set of scopes the integration needs.
Create key
Copy the plaintext token immediately. NOCK shows it only once.
Scopes
| Scope | Meaning |
|---|---|
tickets:read | Read project metadata, ticket lists and ticket details. |
tickets:write | Create tickets and update ticket fields. |
tickets:reply | Add customer-visible replies through Public API or MCP. |
tickets:notes:write | Add private MCP internal notes. |
webhooks:write | Manage webhooks and delivery retries. |
mcp:access | Authenticate against /mcp. |
New general API keys default to tickets:read and tickets:write. Agent Keys
default to mcp:access and tickets:read. Add reply, notes, or webhook scopes
only when the integration needs them.
Project access
| Access | Behavior |
|---|---|
| All projects | The key can access every project in the workspace, subject to scopes. |
| Specific project | The key can access only that project. Cross-project requests are rejected. |
Prefer project-scoped keys for vendors, customer-specific automation, and AI agents.
Key list
The integrations table shows:
| Column | Meaning |
|---|---|
| Name | Human-readable key name. |
| Project | All projects or a specific project. |
| Token | Prefix and last four characters for identification. |
| Scopes | Assigned Public API scopes. |
| Last used | Last observed API usage, or Never. |
| Actions | Revoke the key. |
Revoked keys stop working immediately.
Webhook endpoints
The same integrations area lets you create signed webhook endpoints.
| Field | Meaning |
|---|---|
| Endpoint URL | Public HTTPS URL that receives NOCK events. |
| Project | All projects or a specific project. |
| Events | ticket.created, ticket.updated, ticket.status_changed, ticket.note.created. |
| Signing secret | Plaintext secret shown once when the endpoint is created. |
Store the signing secret in your webhook consumer and verify x-nock-signature before triggering side effects.
Recent deliveries
Recent deliveries show outbound webhook attempts across the workspace:
| Field | Meaning |
|---|---|
| Endpoint | Target URL or deleted endpoint ID. |
| Event | Webhook event type. |
| Status | Delivery state. |
| Attempts | Current attempt count and max attempts. |
| HTTP | Last response status when available. |
| Last attempt | Most recent delivery attempt. |
| Next retry | Scheduled retry time when applicable. |
Use this table to debug failed automations before changing code.