christian/waters-boards
1
0
Fork 0
Code Issues 9 Pull Requests Actions Packages Projects Releases Wiki Activity

Webhook automation action and personal API tokens #2

New Issue
Open
opened 2026-10-19 13:59:42 -04:00 by michael · 0 comments
michael commented 2026-10-19 13:59:42 -04:00
Owner
Copy Link
Copy Source

Building blocks that let other tools work with Boards, so Boards doesn't need a built-in connector for every service. With these in place, Zapier, Make or a self-hosted n8n can connect Boards to almost anything.

Webhook action

  • New automation action: "send to a web address", which POSTs JSON about the item and what changed.
  • Signed requests: each automation gets its own secret, and requests carry a signature header so the receiver can check they came from Boards.
  • Delivery: retries with backoff, plus a delivery log admins can read.

Personal API tokens

  • Creating one: a signed-in person creates a token from their account, so it acts as them with their permissions.
  • Storage: the token is shown once and stored only as a hash.
  • Revoking: the person or an admin can revoke it. Deactivating or deleting the person revokes all of their tokens.
  • Today: the server already accepts Authorization: Bearer <token> in place of the session cookie. But the only tokens are short-lived sign-in sessions, so there's no way to get one for an integration.

Docs: document the REST endpoints an integration needs, such as reading boards, creating and updating items, and posting updates.

This is the same groundwork as #5, the API for staff AI agents. #3 (Google Calendar and Slack) builds on the webhook action.

Building blocks that let other tools work with Boards, so Boards doesn't need a built-in connector for every service. With these in place, Zapier, Make or a self-hosted n8n can connect Boards to almost anything. **Webhook action** - **New automation action:** "send to a web address", which POSTs JSON about the item and what changed. - **Signed requests:** each automation gets its own secret, and requests carry a signature header so the receiver can check they came from Boards. - **Delivery:** retries with backoff, plus a delivery log admins can read. **Personal API tokens** - **Creating one:** a signed-in person creates a token from their account, so it acts as them with their permissions. - **Storage:** the token is shown once and stored only as a hash. - **Revoking:** the person or an admin can revoke it. Deactivating or deleting the person revokes all of their tokens. - **Today:** the server already accepts `Authorization: Bearer <token>` in place of the session cookie. But the only tokens are short-lived sign-in sessions, so there's no way to get one for an integration. **Docs:** document the REST endpoints an integration needs, such as reading boards, creating and updating items, and posting updates. This is the same groundwork as #5, the API for staff AI agents. #3 (Google Calendar and Slack) builds on the webhook action.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
michael (Michael McGary) christian
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: christian/waters-boards#2