Skip to main content

​
API Keys and Webhooks

​
What does this do for me?

The Settings screen lets you create API keys to connect your own tools to the DelegatedSSL API, and register webhook URLs to receive real-time events as domains and certificates change.

​
Create an API key

  1. Open Settings in the signed-in portal.
  2. Under API Keys, choose Create Key.
  3. Select the scopes you need:
    • domains:read — read domain and certificate data
    • domains:write — create and update domains (includes read)
    • clients:read — read client data
    • clients:write — create and update clients (includes read)
    • reports:read — view weekly green reports
    • webhooks:write — manage webhook subscriptions
  4. Copy the key immediately. It is shown once and cannot be retrieved later.
To rotate or revoke a key, open Settings and choose Rotate or Revoke next to the key.

​
Set up a webhook

  1. Open Settings under Webhooks.
  2. Choose Add Webhook and enter your endpoint URL.
  3. Select which events to receive:
    • domain.created
    • domain.validation_verified
    • domain.validation_error
    • certificate.active
    • certificate.blocked
    • verification_link.opened
    • verification_link.completed
  4. Save the webhook. Each webhook carries its own signing secret that DelegatedSSL displays when the webhook is created.

​
How webhook deliveries are signed

For each event, DelegatedSSL sends a POST request to your endpoint URL with an application/json body. Every delivery includes three headers:
  • X-DelegatedSSL-Event — the event name (for example, certificate.active).
  • X-DelegatedSSL-Delivery — a unique delivery identifier.
  • X-DelegatedSSL-Signature — a signature in the form sha256=<hex>.
The signature is an HMAC-SHA256 of the exact raw request body, computed with your webhook’s signing secret. To verify a delivery, recompute the HMAC-SHA256 of the raw body with that secret and compare it to the value in the X-DelegatedSSL-Signature header. The body is a JSON object with the event type, a timestamp, and the domain or certificate fields that changed. The full payload shape and a verification example are covered in the developer API reference.