API and Webhooks

Drip Drop provides a public API for account-level integrations. Use API keys to authenticate server-side tools, scripts, and integrations that need to work with your Drip Drop account.

This page covers API key management and outbound webhook endpoints in Admin. For provider webhook setup, use Integrations. For webhook actions inside flows, use the Flow Editor. It does not duplicate the endpoint reference.

For endpoint details, schemas, request and response examples, and testing, use the live API docs: https://api.dripdrop.dev/docs/

API management page with a synthetic HubSpot testing key and active HubSpot Sync webhook for contact events.

Before using the public API:

  • You need access to the Drip Drop account whose data you want to integrate with.
  • The account must be active.
  • The account must have an active subscription.
  • Public API access may be rejected if the account subscription is missing or lapsed.
  • API usage may be subject to plan-based limits or quotas.

Go to Settings → API Keys.

The API Keys panel lets you create and manage keys for the public API. If no keys exist, create one to start using the public API.

The page may show active and revoked keys separately. Existing keys show limited metadata, such as:

  • Key name
  • Key prefix
  • Creation date
  • Expiry date, if set
  • Revocation status
  1. Go to Settings → API Keys.
  2. Click Create API Key.
  3. Enter a name for the key.
  4. Optionally set an expiry date.
  5. Create the key.
  6. Copy the generated key immediately.

The full key is only shown once after creation. After you close the modal, Drip Drop only shows the key prefix.

Treat API keys like passwords.

Do:

  • Store keys in a server-side secret manager or environment variable.
  • Use a separate named key for each integration where possible.
  • Set expiry dates for temporary or vendor-specific access.
  • Rotate keys when staff, vendors, or automation ownership changes.

Do not:

  • Put API keys in client-side code.
  • Commit API keys to a public or private repository.
  • Share keys in screenshots, support tickets, chat messages, or public docs.
  • Reuse one key for every integration if separate keys would be safer.

Use the live API docs as the source of truth for endpoint paths, required fields, request and response schemas, authentication requirements, and error responses.

  1. Find the endpoint you want to call.
  2. Review its required fields, request example, response schema, and documented errors.
  3. Send your API key in the X-API-Key header.
  4. Use the endpoint-specific path and request body shown in the live API docs.
X-API-Key: ***

Expired keys stop working. Revoked keys stop working immediately and cannot be restored.

If an integration uses a revoked key, update that integration with a new key.

Public API requests may fail if:

  • The API key is expired.
  • The API key was revoked.
  • The key was copied incorrectly.
  • The account is inactive or suspended.
  • The account does not have an active subscription.
  • The request is missing the X-API-Key header.

Public API activity is attributed to the account associated with the API key.

Use account-level webhooks to send Drip Drop events to an external HTTPS receiver. This section covers public API subscriptions and delivery verification; it does not document webhook actions inside the Flow Editor.

Active synthetic HubSpot Sync webhook showing its contact events, masked signing secret, status, and endpoint controls.

Authenticate and manage subscriptions

Authenticate public API webhook requests with an API key and the X-API-Key header. The public API supports listing, retrieving, creating, and deleting webhook subscriptions. Creating a subscription returns its signing secret once; store it securely because later responses do not return it.

X-API-Key: YOUR_API_KEY
New Endpoint form configured with a synthetic HubSpot callback URL and four contact events selected before creation.

Choose events

Use the event-types endpoint in the live API docs to discover the available event types and descriptions. A wildcard subscription uses * for events included in wildcard delivery; it cannot be combined with specific event types. Events that require explicit selection are not included by a wildcard subscription.

Verify deliveries

Drip Drop sends the X-DripDrop-Signature header with webhook deliveries. Use the signing secret returned when the subscription was created to verify deliveries. For the current signature contract, event payload schemas, and request examples, use the live API docs.

A webhook envelope includes the API version and an events array. The current implementation sends one event per envelope with an event type, event ID, creation timestamp, account UUID, and event data.

Webhook delivery history for HubSpot Sync showing a successful contact update, HTTP 200 response, one delivery attempt, and the last-attempt timestamp.

Recover from webhook failures

  • If the API rejects a webhook request, check that the API key is active and has access to the api resource.
  • If signature verification fails, use the signing secret returned at subscription creation and verify the exact delivery received by your endpoint.
  • If a subscription should no longer receive events, delete it through the public API. Deleting a subscription drops queued deliveries.
An API request fails
  1. The key was copied correctly.
  2. The key has not expired.
  3. The key was not revoked.
  4. The account is active.
  5. The account subscription is active.
  6. The request uses the X-API-Key header.
  7. The request is sent to https://api.dripdrop.dev.
  8. The endpoint, method, and payload match the live API docs.
An API key was lost after creation

If the raw key is no longer visible, create a new key and revoke the old one instead of expecting Drip Drop to reveal the old secret again.

  • Admin — manage account-level API access and webhooks.
  • Integrations — configure provider-specific webhooks.
  • Flow Editor — use webhook actions inside flows.
  • Live API docs — view endpoint paths, schemas, examples, and errors.