# Webhooks and API Tokens

**Category:** [Account & Organisation](https://help.totalctrl.app/hc/totalctrl/totalctrl-help-center/en-US/categories/account-organisation)
**Updated:** 2026-08-19

## API tokens

Go to **Settings → Developer → API tokens → New token**. Each token has a scope: All, Platform, or App. The token secret is shown once on creation — store it immediately in a secrets manager.

## Webhooks

Go to **Settings → Developer → Webhooks → New webhook**. Enter your HTTPS endpoint URL, select which events to subscribe to, and optionally add a shared secret for HMAC signature verification.

## Event payload format

  
- `event` — the event type string (e.g. `crm.contact.created`)
  
- `timestamp` — ISO 8601 UTC timestamp
  
- `data` — the object that triggered the event

---

## Related Articles

- [Deleting your account](https://help.totalctrl.app/en-US/articles/account-delete)
- [Audit Logs](https://help.totalctrl.app/en-US/articles/audit-logs)
- [Team Members and Roles](https://help.totalctrl.app/en-US/articles/team-members-and-roles)
- [Billing and Plans](https://help.totalctrl.app/en-US/articles/billing-and-plans)
- [Upgrading your plan](https://help.totalctrl.app/en-US/articles/account-upgrade)

---
[← Back to TotalCtrl Help Center](https://help.totalctrl.app/en-US/)