API Tokens
An API token authenticates automation — most often the Terraform provider — against the Webhookr API. A token acts on behalf of the user who created it.
Format & usage
Tokens are prefixed and opaque:
whk_<random>
Send a token as a bearer credential:
Authorization: Bearer whk_xxxxxxxxxxxxxxxxxxxxxxxx
Model
| Field | Description |
|---|---|
id | Unique identifier. |
name | A label identifying where the token is used. |
description | Optional longer note. |
createdAt | When it was created. |
lastUsedAt | When it was last used to authenticate. |
expiresAt | Expiry time, if set. |
revokedAt | When it was revoked, if applicable. |
Storage & security
- Webhookr stores only a hash of the token, never the raw value.
- The token is managed by Webhookr's identity layer (Firebase); the raw value is not recoverable from the Webhookr database.
- The full value is shown once, at creation — copy it immediately.
- Revoking a token takes effect immediately.
Managing tokens
- Dashboard: API Tokens under Settings.
- Terraform: supply via
WEBHOOKR_API_TOKEN— see Authentication.