What it does
Scoped API keys authenticate the REST API and the built-in MCP server so scripts and AI assistants can act on the workspace directly; webhooks push events out the moment they happen, signed so you can verify they're genuine.
Who needs it
Anyone connecting IterDone to another tool, writing an integration, or wiring an AI assistant like Claude up to their workspace.
Why use it
A key can be locked to read-only, to one space, or both, so an integration only ever reaches exactly the data it needs. With 119+ documented REST endpoints and a 87-tool MCP server, essentially everything the UI can do, a script or an assistant can do too.
How it works
Admin > API Keys and Admin > Webhooks are how anything outside the UI — a script, an integration, or an AI assistant — reads and writes this workspace's data.
An API key authenticates REST calls (/api/v1/..., sent as Authorization: Bearer <key>) and the built-in MCP server (/mcp). Creating one asks for:
- Name — a label so you can tell keys apart later.
- Scopes — read (list/get spaces, lists, tasks, comments) and/or write (create, update, delete tasks and comments). Pick either or both.
- Space — leave it as "All spaces" for an unrestricted key, or lock it to one space. A space-scoped key is enforced server-side on both the REST API and MCP tools — it can't see or touch anything in other spaces, and workspace-level features (Goals, Docs, Webhooks, creating new Spaces, workspace export/import) are off-limits to it entirely.
- Expires — never, or in 30, 90, or 365 days.
The plaintext key is shown exactly once, at creation — copy it before leaving the page. The API Keys page also has ready-to-paste MCP connection snippets for Claude Code and Claude Desktop, pre-filled with a freshly created key, plus a link to the interactive API docs. A key can be revoked at any time from the table; a revoked or expired key stops working immediately.
A webhook instead pushes to you: pick an endpoint URL and which events to subscribe to (or "All events"), and this workspace sends an HTTP POST to that URL whenever one fires — task created, updated, moved or deleted, status, priority, assignee or due-date changes, and comments posted, plus the same created/updated/deleted set for lists, folders, spaces and goals. Every request carries an X-Signature header (HMAC-SHA256 of the raw body, keyed by the webhook's secret) so you can verify it actually came from here. Each webhook's row shows when it last fired, its last HTTP status, and running delivery/failure counts; Send test fires a one-off ping event, and Deliveries expands a log of recent attempts with status, duration and outcome.