API keys
A key belongs to a user and can do exactly what that user can do in the browser — the same roles and approval guards apply. Docs: /api/openapi.json (imports directly into Power Automate / Logic Apps as a custom connector) · see API.md in your download for a walkthrough.
Webhooks
POSTed as JSON on each selected event, signed with X-Leavora-Signature: sha256=HMAC(body, secret). One delivery attempt with a 5s timeout — check the log below if a receiver was down.