Skip to main content
Studio’s API Keys and Webhooks pages manage the same keys and webhooks as Triggr Core’s Settings > API and Webhooks: one Public API at https://api.triggr-app.com/api/v1 for your whole organisation. Only organisation admins can see or change them. Scopes, retries and signature checks are in API and webhooks.

API keys and webhooks: create a scoped key, find the API reference and add a signed webhook (1:25).

​
Create an API key

1

Open API Keys

Go to Settings > API Keys and click Create Key.
The API Keys page with Refresh and Create Key buttons and three keys: Client portal with the executions:manage scope and PSA status sync, both Active with Roll and Revoke, and Old reporting script, Revoked.
2

Name it and choose scopes

Enter a Key Name that says where it’s used. Every key can read your clients, forms, workflows and runs; tick a scope only if the key needs more, then click Create Key.
The Create API Key dialog with Key Name Client portal, a note that every key can list clients, forms, workflows, executions and Core requests, and Scopes Run Core forms natively, Configure Core workflows and Act on running work, with Act on running work ticked.
3

Copy the key

Click Copy next to Your API Key and store it in your portal or password manager. Studio shows it once, and it expires after a year.
The API Key Created Successfully dialog warning Copy this key now. You won't be able to see it again!, a sample tpk_ key with a Copy button, an expiry date, an Example Request curl command for /api/v1/forms, and the scope executions:manage.
Act on running work (executions:manage) lets the key approve or reject approvals, complete manual steps, and cancel or retry runs. Roll issues a new key and keeps the old one working for the grace period you pick (1, 24 or 72 hours); Revoke stops it at once.

​
Explore the API

Tools > Developer API documents every endpoint with code samples, links to the OpenAPI (JSON) file, and ends with Try it, which sends real requests with a key you paste in.
The Triggr Public API page with API Keys and OpenAPI (JSON) buttons, the base URL https://api.triggr-app.com, an On this page list from Getting started to Webhooks, and the Getting started section showing the Authorization: Bearer tpk_ header.
Send the key as a bearer token:
Every key can embed a Studio form as an already-signed-in user (Embedding Studio forms). To start a workflow from your own system, use the workflow’s Webhook trigger. For AI coding tools, use an MCP token instead.

​
Add a webhook

For example, send every failed Studio run to your PSA so someone picks it up.
1

Add the endpoint

Go to Settings > Webhooks and click Add Webhook. Enter an https Endpoint URL on a public host, tick the Events you want (or All events) and click Add Webhook.
The Add Webhook dialog with Endpoint URL https://portal.yourmsp.com/hooks/triggr, Description Portal notifications, All events unticked, and execution.completed and execution.failed ticked among sixteen events.
2

Copy the signing secret

Click Copy next to Signing secret and store it where your endpoint can read it. Studio shows it once.
The Webhook added dialog warning the signing secret is shown once, a sample whsec_ secret with a Copy button, and a note that each delivery carries an X-Triggr-Signature header.
3

Send a test

Click Test on the webhook’s row; a toast reports your endpoint’s answer. Deliveries lists what was sent, with Redeliver on each.
The Webhooks page listing two Active endpoints on yourmsp.com, one for execution.completed and execution.failed and one for all events, with Last delivery, Registered by, and Test, Rotate secret, Deliveries and Delete buttons.
The Recent deliveries dialog for https://portal.yourmsp.com/hooks/triggr listing execution.completed, execution.failed and ping deliveries, each delivered with an HTTP 200 or 204 code and a Redeliver button.
Check each delivery’s X-Triggr-Signature as shown in Verify the signature.

​
Troubleshooting

Ask an organisation admin to create the key or webhook, or to change your role.
The page shows only for organisation admins.
The URL must be https on a public host and answer within 15 seconds without redirecting. Fix the endpoint, then click Test again.
It failed too many deliveries in a row. Fix the endpoint and click Enable on its row.
The key is mistyped, revoked or over a year old: create a new one. missing authorization header means the request didn’t send Authorization: Bearer tpk_....