Create and use an API key
Open Developers in the Conveliq app and create a named API key. The full key is shown once, so store it in your server-side secret manager.
Send the key on every request with the Authorization header using the Bearer scheme: Authorization: Bearer lc_live_… . Never expose an API key in browser code.
Read contacts and conversations
GET /api/v1/contacts returns active, unblocked contacts for your organization. Use limit (maximum 200) and cursor for pagination.
GET /api/v1/conversations returns recent contacts with their latest message. Use limit up to 100. Both endpoints require an API key with the read scope.
Subscribe to webhook events
Create webhook endpoints from Developers and subscribe to message.received, message.sent, contact.created, contact.updated, escalation.created, or escalation.resolved.
Deliveries are JSON POST requests and include X-Conveliq-Event, X-Conveliq-Delivery-Id, and X-Conveliq-Signature headers.
Verify webhook signatures
The signature header contains t=<unix timestamp>,v1=<hex digest>. Compute HMAC-SHA256 over timestamp + '.' + the raw request body using the webhook signing secret, then compare the digest in constant time.
Reject stale timestamps and invalid signatures before parsing or acting on the event payload.