Articles on: Partner Portal

How to Manage Webhooks and API Keys for a Customer Account

How to Manage Webhooks and API Keys for a Customer Account


In this article:

  • Overview
  • Before you start
  • How to add a webhook for a customer account
  • How to edit, re-key or delete a customer's webhook
  • How to see a customer's webhook deliveries
  • How to generate an API key for a customer account
  • How to revoke a customer's API key
  • Things to keep in mind
  • FAQs
  • Who can do this


Overview


From the Partner Portal you can set up and look after the webhooks and API keys of any customer account you manage, without signing in to that account. This is useful when your own platform is the one receiving the account's webhooks or calling the SuperPath API on its behalf.


Each customer account's detail page has a Webhooks tab and an API Keys tab. They work like Settings → Integrations inside the account, with one difference: every webhook and API key must belong to a person in the customer account, so you choose who it belongs to.


Before you start


  • Pick the person each webhook or key belongs to. It must be an active Owner or Admin of the customer account. You cannot choose yourself, because you are a user of your partner account, not of the customer's.
  • Know why that matters for API keys. An API key acts as the person it belongs to, with that person's current permissions. If they later lose their Owner or Admin role, or are disabled, the key stops working for changes.
  • Have your endpoint ready. Webhook endpoints must be public HTTPS URLs on port 80 or 443. For how to build one, see Webhooks - Get updates in real-time.


How to add a webhook for a customer account


  1. Go to Partner Portal → Accounts and click the customer account's name.
  2. Open the Webhooks tab.
  3. Click Add Webhook.
  4. Enter the Endpoint URL (it must start with https://) and a Description.
  5. Under Owner, choose an Owner or Admin of the customer account. Each option shows the person's email and role. If the list is empty, the message "This account has no active owners or admins." means you need to give someone in the account one of those roles first.
  6. Under Subscribed events, choose one or more events.
  7. (Optional) Turn on Use webhook signature authentication so your endpoint can check each request really came from SuperPath.
  8. Click Add. The button stays greyed out until you have chosen an owner.
  9. If you turned on signature authentication, the Webhook signing secret window opens. Copy the secret key now and put it on your endpoint: it is only shown once.


The webhook appears in the table with its Description (and URL underneath), Events, Owner, Last event, Health and Status.


How to edit, re-key or delete a customer's webhook


Each webhook's row has four actions on the right:


  • View logs: opens the delivery log for that webhook (see below).
  • Edit (pencil): change the URL, description, owner, events or signature setting, then click Update. If you turn signature authentication on, the new secret key is shown once after you save.
  • Regenerate secret (circular arrows): only on webhooks that use signature authentication. It replaces the secret key straight away and shows the new one once. Update your endpoint at the same time, or it will start rejecting deliveries.
  • Delete (trash): confirm with Confirm delete. This can't be undone.


The Health column tells you at a glance whether a webhook is Healthy, has N failing deliveries in a row, or has had No recent successful deliveries in the last 30 days.


How to see a customer's webhook deliveries


  1. On the customer account's Webhooks tab, click View all logs to see every delivery for the account, or click View logs in a webhook's row to see only that webhook.
  2. The delivery log opens in place of the table, headed "Webhook delivery log for" and the account name.
  3. Use the filter, the date range and the search box to find a delivery, and click a row to see the payload sent and the response your endpoint returned.
  4. Click Back to webhooks to return to the table.


Deliveries are kept for 30 days, and failed deliveries are retried up to five times over about 8.5 hours. For what each column and outcome means, see the help article Webhook Logs: Monitor and Troubleshoot Your Webhooks.


How to generate an API key for a customer account


  1. Go to Partner Portal → Accounts and click the customer account's name.
  2. Open the API Keys tab.
  3. Click Generate new key. The Generate New API Key window opens.
  4. Optionally enter a name that describes what the key is for.
  5. Under Acts as, choose the Owner or Admin of the customer account the key will act as.
  6. Click Generate.
  7. Copy the key straight away. It is shown once, with a line confirming which person and account it acts as, and it can't be shown again after you close the window.


The key appears in the table with its Name, Acts as, Status and Last modified date. If the person a key acts as is no longer an Owner or Admin, the row warns "No longer an admin. Writes will fail."


How to revoke a customer's API key


  1. On the customer account's API Keys tab, find the active key and click Revoke.
  2. Click Confirm revoke.


The key stops working straight away and stays in the table as revoked. Revoking can't be undone, so generate a new key if the integration still needs access.


Things to keep in mind


  • These tabs are not limited by the customer's plan. You can manage webhooks and API keys for any account you manage, even one on a free plan.
  • Secret keys and API keys are shown once. SuperPath never shows them again, in the portal or in the customer account. If one is lost, regenerate the webhook secret or generate a new API key.
  • An API key acts as its owner with that person's live permissions. Reading data keeps working if they are demoted, but changes are refused, so choose someone whose role is not likely to change, and keep an eye on the "No longer an admin" warning.
  • Admins and Owners of the customer account see the same webhooks and keys in Settings → Integrations, and can change or remove them there.
  • You can only manage accounts that belong to your partner account.


FAQs


Why can't I choose myself as the owner?
You are a user of your partner account, and a webhook or API key has to belong to a person inside the customer account. Choose one of that account's Owners or Admins.


What happens to a key if the person it acts as leaves?
If they are disabled or lose their Owner or Admin role, the key can still read data but changes made with it are refused. Generate a new key that acts as someone else, update your integration, then revoke the old one.


Can I see the secret key of a webhook someone else created?
No. Nobody can see a secret key after it was first shown. Use Regenerate secret to create a new one, and update the endpoint that receives the webhook.


Will the customer know I added a webhook?
Yes. It appears in their Settings → Integrations → Manage Webhooks table like any other webhook, with the owner you chose.


Who can do this


Owners and Admins of a Partner account can manage customer webhooks and API keys from the Partner Portal. Other roles in the Partner account cannot open the Partner Portal. Inside the customer account itself, the webhooks and API keys you create are visible to that account's Owners and Admins in Settings.

Updated on: 26/10/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!