NEW Webhook Events - API Key vs OAuth

API & SDK
1

Originally posted by David List

Hey Guys,
Just been testing out the new webhook events and it’s awesome. But, it appears there is no support for Auth using API Keys? OAuth is working fine. Will API Keys be supported for these events?

2

I was able to subscribe to webhook using API Key and it is working

3

Heres a helper i wrote to assist with subscribing to webhooks

https://pastebin.com/FWAdxR1z

4

Thanks heaps for sharing that helper, Anthony :+1:

Just to clarify though — your snippet is hitting the /webhook_subscriptions/object endpoint. That one did originally only support OAuth (you even had to swap a code to prove the registration), but ServiceM8 added API key support in the last 6 months, which has been great because it doesn’t require any auth flow to register a webhook.

The bit I’m talking about is the newer /webhook_subscriptions/event endpoint. That one currently only works with OAuth — you don’t need to swap a code anymore, which is a win, but it would be even nicer if it also supported API keys like the object endpoint now does.

5

Hey Guys,

I’ve just confirmed with team that both the old object style webhooks and the new event based webhooks are compatible with oAuth and API Keys. To make API Keys even more accessible for people getting started we’ve dropped the requirement to respond to a challenge when connecting a new url.

More Info here:
https://developer.servicem8.com/docs/webhooks-overview#/

Cheers,

Cody

6

Hey Cody, thanks again for the clarification earlier — that really helped. After more testing I’ve found two separate issues worth flagging :backhand_index_pointing_down:

1. GET /webhook_subscriptions with API Key

  • Event-based webhooks can be registered successfully with an API key and events do fire correctly to the callback URL.
  • But calling GET /webhook_subscriptions with an API key does not return any of the event-based webhooks — it just comes back empty.
  • Object-based webhooks do return correctly when using the same endpoint with an API key.

2. DELETE on Event Webhooks with OAuth2

  • I registered six event webhooks (job.invoice_paid, job.quote_accepted, job.created, job.status_changed, job.invoice_sent, and company.updated).
  • Using OAuth2, the GET /webhook_subscriptions endpoint correctly showed them all in an array.
  • When I attempted to delete just one of those event webhooks via the DELETE endpoint, it instead deleted all event webhooks — not just the targeted one.
  • It even removed unrelated object-based webhooks.

So to summarise:

  • API Key issue: Event webhooks don’t appear in GET /webhook_subscriptions despite being registered and firing correctly.
  • OAuth2 issue: Deleting a single event webhook wipes out all event-based (and possibly object-based) subscriptions instead of just the specified one.

If the team can take a look at these two, that’d make the new event webhook system bulletproof — the functionality itself is awesome, just a couple of rough edges here.

Cheers,
David