Developer
Developer help articles
Add a webhook endpoint
Add a webhook endpoint Webhooks push events from Orvoro to a URL you control, so your systems can react in real time. Steps 1. Go to Webhooks in your dashboard and click Add webhook. 2. Enter your endpoint URL (must be publicly reachable over HTTPS). 3. Choose the events to send. 4. Save the signing secret — use it to verify each request really came from Orvoro. 5. Use Send test event to confirm your endpoint receives it. Check the delivery log and retry failed deliveries. Verify signatures Each request is signed with your secret. Recompute the signature on your server and compare before trusting the payload. Troubleshooting - Deliveries failing — your endpoint must return a 2xx quickly; check it's reachable and not blocking Orvoro's IPs. - Signature mismatch — ensure you're hashing the raw request body with the exact secret. Related: Create and manage API tokens · Route form submissions
Create and manage API tokens
Create and manage API tokens Steps 1. Go to Settings → API tokens. 2. Click Create and set: - Scopes — what the token is allowed to do (grant only what's needed). - Expiry — when it should stop working. - IP allowlist / CIDR — optionally restrict which IPs can use it. 3. Copy the token now — it's shown only once. Store it in a secret manager, never in code you commit. 4. Revoke a token any time from the same page. Security tips - Use separate tokens per integration so you can revoke one without affecting others. - Prefer short expiries and the narrowest scopes. Troubleshooting - 401 Unauthorized — the token may be expired, revoked, or blocked by the IP allowlist. - Lost the token — you can't view it again; revoke it and create a new one. Related: Create integration keys · Add a webhook endpoint
Create integration keys
Create integration keys Integration keys let external tools (for example the Orvoro Forms/Contact Form 7 plugin) connect securely to your account. Steps 1. Go to Settings → Integration keys. 2. Click Create a key and give it a recognizable name. 3. Copy the key and paste it into the tool or plugin you're connecting. 4. Remove a key from the same page to revoke access. Security tips - One key per integration, so revoking one doesn't break the others. - Treat keys like passwords — don't share or commit them. Troubleshooting - Plugin can't connect — re-copy the key exactly; make sure it hasn't been removed. - Suspect a leak — delete the key and issue a new one. Related: Create and manage API tokens · Add a webhook endpoint · Build a form and embed it