Issue.coffeeSuite.coffee
Public channel and automation

Use the Issue API and signed webhooks

Integrate issue records with scoped credentials, signed delivery and retry visibility.

1 min readUpdated Aug 23, 2026

Connect trusted systems with scoped API credentials and signed webhook delivery.

Before you start

  • Identify the trusted integration and HTTPS receiver.
  • Prepare secure secret storage and retry handling.
Issue connectivity settings with API token controls, endpoint and signed webhook fields.
Connectivity keeps credentials scoped to one instance and exposes webhook delivery status for diagnosis.

Protect API credentials

Enable the API and generate a token only for a trusted integration. The token is shown once; rotating it invalidates the previous credential.

Use concurrency and scope

The API lists, creates, reads, updates and changes status only inside the public-slug instance. Send the current lock version when updating to detect stale writes.

Verify webhook delivery

Configure an HTTPS receiver and secret. Deliveries are signed and attempts remain visible for diagnosis. A webhook is a notification, not proof that the remote system processed the event.

Step by step

  1. Open Connectivity in Settings.
  2. Enable API only for a trusted consumer.
  3. Generate and store the one-time token securely.
  4. Configure HTTPS webhook URL and secret.
  5. Verify signatures, retries and delivery history.

Final check

  • The token is stored outside logs and screenshots.
  • Updates send the current lock version.
  • The receiver verifies every signature.
Tip: A delivered webhook proves transport, not that the remote system completed its own processing.