AI & Integrations | Workspace
Use API tokens, mobile sessions, and webhooks
Create least-privilege access for approved integrations and test it without exposing tokens or crossing company boundaries.
Sign in to your company workspace to use the related controls.
What this section includes
- API tokens
- Mobile sessions
- Booking and customer API
- Device registration
- Webhooks
Start-to-finish instructions
Define the integration
List the exact data and actions required, the owning company, and the person responsible.
Create least-privilege access
Choose only required scopes and store the token in the integration's secret manager.
Run read-only tests first
Verify identity, summary, customer, schedule, or device responses before creating or changing records.
Test one write
Use a labeled record and confirm permission, validation, tenant isolation, and duplicate protection.
Rotate and revoke
Replace exposed or old tokens, end unused sessions, and confirm the integration stops when access is revoked.
What success looks like
- The integration can do only the approved actions.
- All returned and created data belongs to the intended company.
Common problems
- Never put a token in a screenshot, URL, public repository, or Help article.
- A 401 or 403 response should be fixed by reviewing access, not by broadening every permission.