Authentication

Inbound webhooks support two authentication methods. Most integrations should use token auth. JWT is available for advanced OAuth clients.

Token auth (recommended)

The webhook token is embedded directly in the URL path. No Authorization header is needed.

POST {WEBHOOK_BASE_URL}/{token}/contacts/create-with-ai
Content-Type: application/json

The token must be:

• A valid v4 UUID
• Matching an active IncomingWebhook row for your organization
• Not disabled by an org admin

If the token is invalid, missing, or belongs to a disabled webhook, the server returns:

401 Unauthorized

{ "error": "Unauthorized" }

JWT auth (advanced)

The contact endpoints also accept a standard JWT with the contacts:create scope. This is intended for OAuth clients and server-to-server integrations that already manage tokens.

When using JWT, pass the token in the Authorization header:

POST {WEBHOOK_BASE_URL}/contacts/create-with-ai
Authorization: Bearer {jwt}
Content-Type: application/json

Auth errors