Installation, identity and privacy
What is the difference between a support API and a webhook?
A support API lets your integration request data or perform permitted actions. A webhook sends your system an event when something happens, such as a new customer message or an assignment change. Use them together when an external system needs to stay informed and occasionally read or update a conversation.
When should you call an API?
Call an API when your system needs a current record, a list of conversations, or an authorized update. Keep credentials on a trusted server and choose the narrowest available permissions. A public widget key and an administrative integration key serve different purposes and should not be interchangeable.
How should an event receiver behave?
Verify the provider’s signature using the exact received body, identify the event type, and process the event safely. Decide what should happen if the same event is received again or if two systems would otherwise echo each other’s replies. Subscribe only to information the integration actually needs.
How do you preserve accountability?
Distinguish customer messages, agent replies, and internal notes. An integration that writes on behalf of a person should preserve who initiated the action and respect their access. Review what your external system stores, because sending a webhook creates another copy outside the original inbox.
Practical checklist
- Store API keys and signing secrets on a server.
- Verify event signatures before processing.
- Prevent duplicate writes and message loops.
- Keep private note subscriptions deliberate.
Worked example
A help-desk connector receives a customer-message event and fetches the conversation through the API. When an authorized agent answers in the connected tool, the connector writes that reply with the agent identity and a stable client identifier to avoid duplicate sends.
How Fire Away fits
Fire Away provides read/write API keys, signed webhook events, and agent-attributed conversation writes. Internal-note events require explicit subscription. API keys are organization-wide, so design the receiving integration around that access boundary.