A webhook bot has two different secrets, and they do opposite jobs. Both are shown to you exactly once, so it is worth understanding them before you create a bot rather than afterwards.

One secures traffic coming in to your bot. The other secures traffic going back to Bookboost. You need both.

The moment you finish creating a webhook bot, Bookboost shows a Bot Created screen with a Signing Key (HMAC). The screen says it plainly:

"Webhooks will be signed using this HMAC key. Please copy it and store it in a secure place. This is the only time you can access this value. If you lose it you must generate a new key."

Every webhook call Bookboost makes to your URL is signed with this key. Your bot uses it to check that a request genuinely came from Bookboost and not from someone who found your webhook URL.

Copy it before you leave that screen. There is an eye icon to reveal it and a copy icon to take it. Once you select Continue, the value is gone — the bot's settings page does not show it again. If you lose it you have to generate a new one, and your bot's verification has to be updated to match.

Do not paste it into a shared document or a chat message. Put it wherever your team keeps secrets, and give whoever is building the bot access to that rather than to a copy.

On the bot's settings page, below Info, is an API Keys block with a Create API Key button. These are the keys your bot uses to call back into Bookboost — to post a reply, or to fetch something it needs.

To create one, select Create API Key and give it a Name.

You see the key once. As soon as it is named and saved, the value is no longer visible. The table afterwards shows only the key's ID, its Name and when it was Created — never the secret itself. So copy it into your secret store at the moment you create it.

You can have several. There is no need to share one key between everything, and you should not. Each row has its own Delete.

The Name field is the only thing that will ever tell you what a key is for, because you cannot look at the key itself. A name that identifies the integration and where it runs — something like Concierge bot – live or Concierge bot – staging — tells you what you need. A name like test or key 2 tells you nothing, and in six months you will not dare delete it.

This matters most when something has to change. If each integration has its own named key, you can revoke one without taking down the others.

Because a bot can hold several keys at once, you can roll a key over cleanly:

Do it in that order. Deleting first leaves the bot unable to reach Bookboost until the new key is in place.

Bookboost has a separate kind of API key for the platform APIs, which lives under Access Tokens in Settings and is issued by Bookboost support. You cannot create or delete those yourself. See API keys.

The keys on this page are different. They belong to one webhook bot, you create and delete them yourself, and they are not interchangeable with a platform API key. If you are following instructions that say to ask support for a key, you are in the wrong place — and the other way round.

If you have not created the bot yet, start with Creating a webhook bot and giving it team access. For what a bot is allowed to do once it is connected, see What a webhook bot can do in the Unified Inbox.

Open Help at the bottom of the left menu and choose Talk to Us, or email support@bookboost.io.