Skip to content

Ringfully is now Inbound CX What’s new

Talk to salesRequest a demo
Request a demo
Menu

Type a word or two. Press Escape to close.

Course

Connecting your systems: API and webhooks

Connect your own software: API keys for call records, contacts and messages, signed webhooks when something happens, and call flow steps that look a caller up.

  • 3 lessons
  • About 3 min of reading
  • For whoever connects other software

Written by John, Owner and CEO. Last reviewed September 15, 2026.

Screen and button names are quoted as the portal shows them.

Lesson 1

API keys

1 min read

By the end, you can

  • Create an API key and keep it safe.
  • Know what the API can read and change.
  • Know which plans include it.

Steps

  1. The API is on the Pro and Business plans. Open Settings, then API Keys, and press “New API key”.
  2. Name the key after the system that will hold it, and choose when it expires. An organization can have up to 10 active keys.
  3. Copy the key when it is shown, keep it in that system's secret store, and send it as a bearer token.
  4. A key made in the portal can read call records, read and change contacts, and read and send text messages.

The API covers call records, contacts and messages, and nothing else: no live call control, no recordings, no voicemail, and nothing that changes the account's settings.

Read more

Check what you learned

Your answers are checked in your browser. Nothing is saved or sent anywhere.

  1. Which of these can the API do?
  2. Can an organization on the Starter plan create API keys?

Show the answers
  1. Send a text message Messages can be read and sent; live calls and recordings are outside the API.
  2. No, the API is on Pro and Business API access is part of the Pro and Business plans.

Lesson 2

Webhooks

1 min read

By the end, you can

  • Add a webhook endpoint.
  • Check that a delivery really came from your account.
  • Find out why a delivery did not arrive.

Steps

  1. Open Settings, then Webhooks, and press “Add webhook endpoint”. The URL must use HTTPS, and its host must already be on your organization's outbound allowlist.
  2. Three events are sent: call.completed when a call ends, voicemail.received when a voicemail lands, and sms.received when a text arrives.
  3. Each delivery is signed. Compute an HMAC-SHA256 of the x-inboundcx-timestamp header, a period and the raw body, with your signing secret, and compare it with the x-inboundcx-signature header.
  4. A failed delivery is tried again, up to 8 attempts over a little more than two hours. Recent deliveries on the endpoint show what happened.

Verify against the body exactly as it arrived. JSON that has been parsed and written out again will not match the signature.

Read more

Check what you learned

Your answers are checked in your browser. Nothing is saved or sent anywhere.

  1. Which of these is a webhook event?
  2. What does the signature cover?

Show the answers
  1. sms.received The three events are call.completed, voicemail.received and sms.received.
  2. The timestamp and the raw body Signing the timestamp with the body lets you refuse an old delivery replayed later.

Lesson 3

Looking a caller up during a call

1 min read

By the end, you can

  • Approve the addresses a call flow may reach.
  • Look a caller up in your own system before they reach a person.
  • Use a data table when you have no system to call.

Steps

  1. Add your system's host to your organization's outbound allowlist. Call flows and webhooks can only reach approved https addresses.
  2. In a call flow, add API / HTTP request to ask your system about the caller, or Look up in a table for a list you keep under Flow Resources, Data tables.
  3. Branch on the answer with Condition / branch, for example to send a known customer to the team that looks after them.
  4. Start from the template Look the caller up first to see the pattern wired end to end.

A request from a call flow gives up after 5 seconds, so plan what the caller hears when your system is slow.

Read more

Check what you learned

Your answers are checked in your browser. Nothing is saved or sent anywhere.

  1. Your call flow must reach https://orders.example.com. What do you do first?
  2. You have no system to call, only a list of priority numbers. Which step fits?

Show the answers
  1. Add its host to the outbound allowlist Everything not on the allowlist is refused.
  2. Look up in a table A data table in Flow Resources holds the list, and the step reads it during the call.

That was the last course

Every course, and the reading paths built from the guides, are on the University page.

All courses

Ready to answer every call?

See how Inbound CX picks up and routes your calls, in a 15-minute walkthrough.

Book a demo