Use the API and webhooks

The API and webhooks are available on paid plans. On the free plan, the page shows See plans.

Create an API key

1. Open API & webhooks in the sidebar.
2. Under API keys, type what the key is for in What is this key for?.
3. Click Create key.
4. Copy the key now — it isn't shown again. Click Done.

Send it as a bearer token: Authorization: Bearer vws_live_…. A key reads this workspace — events, guest lists, the door log, the guest book — and can issue or revoke invitations. It can't check anyone in, and QR codes are never returned.

A new key carries both api:read and api:write. Keys created before writes existed are read-only; create a new one if a write is refused. Each key allows 600 requests per minute.

To stop a key, click Revoke key. Anything using it stops working immediately.

Add a webhook

1. Under Webhooks, paste your endpoint URL (it must be https).
2. Pick the event types you care about, or select none to get every type.
3. Click Add.
4. Copy the Signing secret for this endpoint — it's shown once.
5. Click Send a test event to post a sample before a real door opens.

Event types: checkin.granted, checkin.refused, invitation.created, invitation.revoked, registration.created, registration.approved, rsvp.updated, online.joined (an online guest opened their personal link), online.attended (Zoom's report confirms they attended, with minutes).

Verify and answer deliveries

• Every request carries an X-VenueWS-Signature header: an HMAC-SHA256 of the timestamp and the raw body, made with the signing secret. Verify it against the raw body and reject old timestamps.
• Answer with a 2xx within 10 seconds. Otherwise it's retried after 30 seconds, 2 minutes, 10 minutes, 1 hour and 6 hours, then marked failed.
• Deliveries can arrive more than once; use the event's id to skip duplicates.

Each endpoint shows its last attempt and how many failed. Use the Enabled switch to pause one, or Remove endpoint to delete it.

Prefer no code? Zapier and Make run on the same key and webhooks.