API & webhooks for operators

Dealer-facing docs live under Open API, webhooks & data export. This page is the operator-side configuration reference.

Environment variables

Variable	Purpose
`WEBHOOK_SECRET`	Signs and gates webhook deliveries
`API_TOKEN_SECRET`	Signs scoped public-API tokens (falls back to service-role key in dev)
`STRIPE_SECRET_KEY` / `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` / `STRIPE_WEBHOOK_SECRET`	Payments charge + webhook paths
`TWILIO_ACCOUNT_SID` / `TWILIO_AUTH_TOKEN` / `TWILIO_FROM_NUMBER`	SMS sender
`RESEND_API_KEY` / `EMAIL_FROM`	Email nurture + transactional sends

Amber pattern

Until the relevant variables are set, the app and docs show a not configured state and the feature will not send, charge, or transmit — there is no fake success path. Set secrets at the deployment (Cloudflare Worker / platform env), never in the browser or marketing site.