Integrations: API keys, webhooks, notifications, sign-in for other sites

The Integrations section collects four ways to link the site with the outside world: “API keys”, “Webhooks”, “Notifications” and “Sign-in for other sites”.

API keys

A key gives an outside program — a warehouse, accounting, your own bot — access to the site on your behalf, but only to what you tick. A key cannot do more than you can: take a permission away from yourself and the key loses it. A key is shown once: the site keeps only its fingerprint and cannot show it again; if you lose it, issue a new one. The program sends the key in the header “Authorization: Bearer nx_…”. The download button gives an OpenAPI file for Postman and client generators: it holds only the endpoints your permissions cover. If no enabled module has anything to give by key yet, the list of scopes is empty.

Webhooks

When something happens on the site — an order is paid, an account is created — the site reports it to the address you give: a warehouse, accounting, a bot. Messages go through the queue. The address must be external: the site does not knock on addresses inside the server or the local network. Every message is signed: the X-Nex1on-Signature header is an sha256 signature of the message body computed with your secret; the receiving side checks it and so knows the message came from your site. If you change the secret, the old one stops fitting and the receiving side has to be reconfigured.

Notifications

Messages about important things — to your phone: a new request, an order, a subscription, a failure. The message is short: the site name, what happened and a number; there are no names, emails or request texts in it. You connect a Telegram bot (you need a chat number or a @channel name, and the bot must be in that chat) or an incoming webhook of Slack or Discord. The webhook address is not shown after saving. Only a limited number of messages go out per hour: once the limit is reached, other events are not sent until the hour ends. A link to the panel can be added to the message with a separate tick, but then the messaging service sees it too.

Sign-in for other sites

Your other sites and apps can accept sign-in through this site’s accounts (OpenID Connect). It works only for clients you create here; the person’s consent is required and access can be revoked — for one client or for all at once. With the person’s consent the client site receives their name, login, language and (optionally) a verified email — only what the scopes allow. Accounts with panel access cannot, by default, sign in to other sites through us: the owner allows it for each client separately.

What you need to turn it on: the site address in the launch settings must be https (http://localhost is allowed on your own computer), the site must have a real encryption key (app.key), and the openssl extension must work on the hosting. After turning it on, the site gets the open addresses /.well-known/openid-configuration and /.well-known/jwks.json (nothing personal in them) and exchange endpoints /oauth/…. A client secret is shown once after creation. Before turning it on, add a paragraph to the site policy about passing data to other sites with the person’s consent.