Create API keys and webhooks

API keys let a script or automation read and write your data through the REST API. Webhooks push events to your server when something happens. Both live on Settings → Integrations.

#Create an API key

1. Open Settings → Integrations and scroll to API keys.
2. Under New key, give the key a Name that says where it is used, for example "n8n workflow".
3. Tick the Scopes the key needs. Pick at least one.
4. Click Create.
5. Copy the key from the green box straight away. It starts with nola_live_ and is shown only once.

Send it with every request as Authorization: Bearer nola_live_…. Keys created before October 2026 start with oh_live_ and keep working; you don't need to replace them. Endpoints, request bodies and examples are in the REST API reference.

The same key also works as a bearer token for AI agents that connect to Nola over MCP but cannot sign in, such as the Grok API. See Connect AI agents with MCP.

Each key can make up to 600 requests a minute. Above that the API answers with status 429.

#Manage keys

The key table shows each key's name, first characters, scopes, Last used and status. Revoke switches a key off for good. To change scopes, create a new key and revoke the old one.

#Add a webhook endpoint

1. On Settings → Integrations, go to Webhooks and find New endpoint.
2. Paste your URL. It must be a full public https:// address such as https://your-n8n.example.com/webhook/nola. Addresses on a private network (such as localhost or 192.168.x.x) and plain http:// are refused. Nola does not follow redirects and waits up to 10 seconds for an answer.
3. Tick the Events you want to receive. Pick at least one.
4. Click Add.

Nola sends these events today:

The list also offers extension.offered and extension.accepted. You can subscribe to them, but Nola does not send them yet.

#How deliveries work

Each event is a POST with a JSON body: event, createdAt and data. The headers include X-Nola-Event with the event name and X-Nola-Signature in the form t=<timestamp>,v1=<signature>. The signature is an HMAC-SHA256 of <timestamp>.<body> using the endpoint's secret. A verification snippet is in the REST API reference. The app does not show the secret yet, so contact support if you need it to verify signatures.

Your endpoint should answer with a 2xx status. Anything else counts as a failure:

• Nola retries with growing waits (up to an hour apart), up to 8 attempts per event.
• After 20 failed attempts in a row, the endpoint is switched off and shows Disabled with the failure count. Fix your server, then click Enable. A successful delivery resets the count.
• Events still waiting for a retry when an endpoint is disabled or deleted are not sent later. They show as failed in the Delivery log.

#Test and troubleshoot

Each endpoint row has these actions:

• Send test: shows "Test event sent", but the test event (test.ping) does not reach endpoints at the moment. To test, make a booking on your own booking page and watch the Delivery log.
• Enable or Disable: pause deliveries without losing the endpoint.
• Delivery log: every delivery with event, status, response code, attempts and time. Deliveries that used up all attempts have a Try again button.
• Remove: deletes the endpoint.

#Legacy webhook URL

Below the endpoints is Legacy webhook URL, an older single-URL setting. It receives unsigned booking events separately from your endpoints. It needs the same plan as endpoints and a public https:// address. If you still use it, move to a signed endpoint and clear the field.

#Related

• REST API reference
• Integrations hub
• AI agents and MCP
• Links and embed