# NEW Webhook Events - API Key vs OAuth **URL:** \ **Category:** API & SDK\ **Created:** [August 31, 2025, 3:45am UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24 "2025-08-31T03:45:59Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [August 31, 2025, 3:45am UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24/1 "2025-08-31T03:45:59Z")
**Originally posted by David List** Hey Guys, Just been testing out the new webhook events and it’s awesome. But, it appears there is no support for Auth using API Keys? OAuth is working fine. Will API Keys be supported for these events? ---
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [September 1, 2025, 11:48am UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24/2 "2025-09-01T11:48:06Z")
I was able to subscribe to webhook using API Key and it is working ---
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [September 1, 2025, 11:56am UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24/3 "2025-09-01T11:56:36Z")
Heres a helper i wrote to assist with subscribing to webhooks [https://pastebin.com/FWAdxR1z](https://pastebin.com/FWAdxR1z) ---
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [September 1, 2025, 7:15pm UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24/4 "2025-09-01T19:15:52Z")
Thanks heaps for sharing that helper, Anthony 👍 Just to clarify though — your snippet is hitting the **`/webhook_subscriptions/object`** endpoint. That one _did_ originally only support OAuth (you even had to swap a code to prove the registration), but ServiceM8 added API key support in the last 6 months, which has been great because it doesn’t require any auth flow to register a webhook. The bit I’m talking about is the newer **`/webhook_subscriptions/event`** endpoint. That one currently only works with OAuth — you don’t need to swap a code anymore, which is a win, but it would be even nicer if it also supported API keys like the object endpoint now does. ---
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [September 1, 2025, 11:05pm UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24/5 "2025-09-01T23:05:18Z")
Hey Guys, I’ve just confirmed with team that both the old object style webhooks and the new event based webhooks are compatible with oAuth and API Keys. To make API Keys even more accessible for people getting started we’ve dropped the requirement to respond to a challenge when connecting a new url. More Info here: [https://developer.servicem8.com/docs/webhooks-overview#/](https://developer.servicem8.com/docs/webhooks-overview#/) Cheers, Cody ---
**Author:** ![developer](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@developer](https://community.servicem8.com/u/developer)\ **Post date:** [September 1, 2025, 11:48pm UTC](https://community.servicem8.com/t/new-webhook-events-api-key-vs-oauth/24/6 "2025-09-01T23:48:17Z")
Hey Cody, thanks again for the clarification earlier — that really helped. After more testing I’ve found two separate issues worth flagging 👇 ### 1. `GET /webhook_subscriptions` with API Key - Event-based webhooks can be **registered** successfully with an API key and events do fire correctly to the callback URL. - But calling `GET /webhook_subscriptions` with an API key does **not** return any of the event-based webhooks — it just comes back empty. - Object-based webhooks do return correctly when using the same endpoint with an API key. ### 2. `DELETE` on Event Webhooks with OAuth2 - I registered six event webhooks (`job.invoice_paid`, `job.quote_accepted`, `job.created`, `job.status_changed`, `job.invoice_sent`, and `company.updated`). - Using OAuth2, the `GET /webhook_subscriptions` endpoint correctly showed them all in an array. - When I attempted to delete **just one** of those event webhooks via the `DELETE` endpoint, it instead deleted **all** event webhooks — not just the targeted one. - It even removed unrelated object-based webhooks. * * * So to summarise: - **API Key issue:** Event webhooks don’t appear in `GET /webhook_subscriptions` despite being registered and firing correctly. - **OAuth2 issue:** Deleting a single event webhook wipes out all event-based (and possibly object-based) subscriptions instead of just the specified one. If the team can take a look at these two, that’d make the new event webhook system bulletproof — the functionality itself is awesome, just a couple of rough edges here. Cheers, David