API and webhooks

Everything a developer needs to build against Productlane: your Workspace ID, API keys and their scopes, outgoing webhooks and their signing secrets, apps connected over MCP, and usage analytics.

Where to find it

Settings > API.

Create an API key

1. In the API keys block, click New API key.
2. Give it a descriptive label.
3. Choose Full access, which grants the admin scope, or Only select permissions and check the scopes the key actually needs.
4. Click Create, then copy the secret and store it somewhere safe.

The secret is shown once. If it is lost, revoke the key and create another.

Set up a webhook

1. In the Webhooks block, click New webhook.
2. Enter a label and the destination URL.
3. Pick the resources you want events for. Threads are selected by default, and at least one resource stays selected.
4. Click Create, then copy the signing secret.

You subscribe per resource: Threads, Messages, Comments, Contacts, Companies, Changelogs, Issues, Projects, Customer needs, Docs, Tags, and Members. The exact action travels in the payload's type field, so subscribing to a resource covers every action on it.

Verify what you receive

Every delivery carries an HMAC-SHA256 signature you check with the signing secret. Read the request body raw, since a framework that re-serializes the JSON breaks the signature. Deduplicate on the event id, because a slow first response can be retried.

Watch deliveries

A webhook's detail page lists its last 200 deliveries. Each row carries the event type, the HTTP status, the time, the attempt number, and how long it took, and expanding one shows the event id, the full payload, and the response body.

Disable stops delivery while keeping the configuration, which is the gentler option when a receiver is down.

Rotate a signing secret

Rotate from the webhook's edit page. The current secret stops working immediately, so receivers still verifying with the old one reject events until you update them. The new secret is revealed once so you can copy it.

Connected apps

Apps authorized over MCP are listed with who connected them, when access was granted, and when it was last used. Revoke access cuts one off immediately, and that person can reconnect by authorizing again.

Analytics

Once you have an active key or a webhook, the page charts your API requests split by success and failure, errors by endpoint, webhook deliveries by status, and P95 response time. The window covers the last 24 hours, 7 days, or 14 days.

Versions

v2 is current, and its keys are prefixed pl_v2_. v1 is deprecated with a sunset date of 20 November 2026. Migrate by creating a v2 key and updating your integration. New keys are always v2.

Good to know

• Revoking a key, deleting a webhook, and rotating a secret all take effect immediately and break anything still using the old value.
• Full endpoint reference and rate limits live in the public API documentation rather than on this page.