Developers: API Keys & Webhooks

If you want to integrate NextCLi into your own systems, you can use an account API key to call the platform APIs, and use webhooks to receive resource and billing events. This article is for developers.

Account API keys

An API key lets you access the platform APIs programmatically, without using your account password:

• Go to "Settings → API keys" and create a new key.
• Copy and store it immediately on creation — for security, the full key is usually shown only once.
• Send the key in requests via the agreed header (such as X-API-Key) to call the APIs.
• Delete keys you no longer use; if you suspect a leak, revoke and recreate immediately.

API credentials: create and manage your API keys

> An API key is equivalent to your identity credential — never hard-code it in front-end code or commit it to a public repository.

Webhooks

> Note: the webhook feature is under development; the console entry currently shows "Coming soon". The usage below is provided so you can prepare ahead.

Webhooks let the platform call back to your service when events occur (such as resource status changes and billing/top-up events):

• Go to "Settings → Webhooks" and add a receiving address (your HTTPS endpoint).
• Select the event types you care about.
• The platform POSTs the event data to that address when an event occurs.

Verifying signatures

To confirm a callback truly comes from the platform and hasn't been tampered with, verify the signature on every callback:

• The platform includes a signature in the request headers; your service computes it with the agreed key and the same algorithm, and compares.
• Requests that fail the comparison should always be rejected.
• Also verify the timestamp and make event handling idempotent (the same event may be re-delivered — don't repeat side effects).

Best practices

• Idempotency: deduplicate by event ID and process each event only once.
• Respond fast: return 2xx from the callback endpoint quickly and do heavy work asynchronously, so the platform doesn't treat it as a failure and retry.
• Least privilege: create separate API keys for different purposes so they can be revoked as needed.

Common questions

• Forgot the key? The full key can't be recovered — delete it and create a new one.
• Not receiving webhooks? Confirm the address is publicly reachable and returns 2xx, and check the selected event types; the platform retries on failure.
• Signature verification keeps failing? Confirm you're using the correct key and algorithm, and compute the signature over the raw (unmodified) request body.

---

Related references

• Authentication and API keys
• API conventions: Request ID, pagination and errors
• Webhooks and events (planned)
• For credential management see: Account: Sign-up, Login & Security