> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API Keys and Webhooks

> Create and manage scoped API keys and register webhook URLs for domain and certificate lifecycle events.

# API Keys and Webhooks

## What does this do for me?

The **Settings** screen lets you create API keys to connect your own tools to the DelegatedSSL API, and register webhook URLs to receive real-time events as domains and certificates change.

## Create an API key

1. Open **Settings** in the signed-in portal.

2. Under **API Keys**, choose **Create Key**.

3. Select the scopes you need:

   * **domains:read** — read domain and certificate data
   * **domains:write** — create and update domains (includes read)
   * **clients:read** — read client data
   * **clients:write** — create and update clients (includes read)
   * **reports:read** — view weekly green reports
   * **webhooks:write** — manage webhook subscriptions

4. Copy the key immediately. It is shown once and cannot be retrieved later.

To rotate or revoke a key, open **Settings** and choose **Rotate** or **Revoke** next to the key.

## Set up a webhook

1. Open **Settings** under **Webhooks**.

2. Choose **Add Webhook** and enter your endpoint URL.

3. Select which events to receive:

   * **domain.created**
   * **domain.validation\_verified**
   * **domain.validation\_error**
   * **certificate.active**
   * **certificate.blocked**
   * **verification\_link.opened**
   * **verification\_link.completed**

4. Save the webhook. Each webhook carries its own signing secret that DelegatedSSL displays when the webhook is created.

## How webhook deliveries are signed

For each event, DelegatedSSL sends a `POST` request to your endpoint URL with an `application/json` body. Every delivery includes three headers:

* **X-DelegatedSSL-Event** — the event name (for example, `certificate.active`).
* **X-DelegatedSSL-Delivery** — a unique delivery identifier.
* **X-DelegatedSSL-Signature** — a signature in the form `sha256=<hex>`.

The signature is an HMAC-SHA256 of the exact raw request body, computed with your webhook's signing secret. To verify a delivery, recompute the HMAC-SHA256 of the raw body with that secret and compare it to the value in the `X-DelegatedSSL-Signature` header.

The body is a JSON object with the event type, a timestamp, and the domain or certificate fields that changed. The full payload shape and a verification example are covered in the [developer API reference](https://docs.pcnaid.com/nodes/web-apps/delegatedssl/developer/api/index.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.