Webhook keys
Generate, identify, rotate, and revoke inbound lead API keys.
Control webhook intake credentials without making the complete key retrievable after creation.
Why it matters
A source-oriented label and masked prefix let operations recognize each credential, while one-time display and explicit revocation reduce the chance that an obsolete or exposed key remains usable.
Where to work
Open Company -> Webhook keys. Generate key creates a new credential; Configured keys shows its Prefix, Label, Scope, Status, Created time, and Revoke action.
Steps
- Under Generate key, enter a label that identifies the sending source rather than a person.
- Select Generate key and copy the value from New key - shown only once directly into the sender's secret store.
- Configure the sender to use X-Api-Key and validate one synthetic request before production data.
- For rotation, use Generate key again to create a labeled replacement; there is no separate Rotate button.
- Move the sender to the replacement and validate it while the old key is still active.
- In Configured keys, match the old masked prefix and select Revoke only after the replacement works.
- Confirm that the revoked key returns 401 and the replacement continues to authenticate the intended source.
See it in HoneyFalcon
Identify active webhook keys by masked prefix and rotate them through the documented lifecycle.
Use an overlap-safe key lifecycle
Generate a key for one source
Use a durable label such as Website form or Partner intake. Avoid placing a complete URL, email address, or secret in the label.
HoneyFalcon shows the complete new key once. Copy it directly to the sending system's secret store before leaving or refreshing the page.
Recognize the key without recovering it
Configured keys shows a masked prefix, label, scope, status, creation time, and action. These values identify the credential operationally without revealing the full secret.
If the complete value is lost, generate a replacement; it cannot be recovered from HoneyFalcon.
Rotate through replacement, not interruption
Select Generate key to create the replacement. Configure and validate it in the sender while the previous key remains active.
After the replacement works, identify the previous prefix in Configured keys and select Revoke. Integrations still using that key stop authenticating.
Verify the boundary
A valid key authenticates the webhook request for its company; an invalid or revoked key returns 401.
The accepted webhook response means the request was queued for processing. It does not by itself prove final routing or allocation.
The complete key is visible only once. Store it directly in the sender, rotate by generating and validating a replacement, and revoke the old key only after the replacement works.
The key lifecycle is controlled when
- Every active key has a source-oriented label and can be identified by its masked prefix.
- No complete key is stored in documentation, screenshots, tickets, or labels.
- A replacement authenticates a synthetic request before the previous key is revoked.
- The revoked key returns 401 while the intended sender continues with the replacement.