Mint a standing inbound-webhook token
Mint a non-expiring, REVOCABLE credential for a custom-delivery (Zapier/Make/no-signature) source’s inbound URL (POST /webhooks/inbound/custom/). The plaintext token and the inbound path are returned ONCE and never retrievable again — only the token’s hash is stored. Pair it with a custom-provider trigger whose provider is the token’s kind. (A provider app-level webhook, e.g. , authenticates by HMAC signature and needs no token.)
Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.