Features / Platform
API and webhooks
Webhooks today, the full API next
Webhooks push events out as they happen, signed and retried. API keys are real, with scopes, live and test modes, and rotation. The public read and write API is versioned and opening next.
Reporting service
tore_sk_live_3f0c2a1b…_a9f2
Stored hashed. After this screen all Tore can show you is the prefix and the last four.
The versioned public API is being opened route by route. Today /v1 answers a version check and nothing else, so you can mint and scope keys and receive webhooks now, but most of what you will eventually call is not exposed on it yet.
What it does
- Webhooks signed with HMAC-SHA256, retried three times, with a per-attempt delivery log
- Redirects are not followed and non-public addresses are refused, so a webhook cannot be pointed inward
- API keys with six scopes, live and test modes, product pinning, hashed storage and rotation with an overlap window
- A key can never be rotated into a wider scope than it started with
- Documentation generated from the API itself rather than written alongside it
Without it
The thing you need is always the one thing the UI will not do
The one thing you need is the one thing it will not do
You want to open a conversation from your own admin tool when a customer's job fails. The vendor's answer is that a person can do it in the browser, which is not an answer, because the whole point was that no person is watching.
The docs describe a version that no longer exists
You build against the documented shape, ship it, and it breaks on a field that was renamed two releases ago. Somebody wrote the docs by hand once and has not been back.
You find out by polling
Your integration asks every five minutes whether anything happened. Most of the time nothing did. The one time it mattered, you were four minutes late and the customer had already emailed twice.
How it works
The interface is a client of the API
Every screen in Tore calls the same API you do. There is no private path the web app uses and you cannot, which is why the surface exists before anyone gets round to documenting it.
Keys are scoped, and cannot be bigger than you
Six scopes, counted from the key schema: read and write for support, knowledge and feedback. Keys come in live and test modes, can be pinned to a single product, and a request to mint a key with more permission than the person minting it is refused.
The number that matters
6scopes
Fixed by the product, not by whoever is on shift.
Rotation has an overlap, so nothing goes dark
You mint the replacement from the existing key, both work while you roll the deploy, and the old one expires on its own. Keys are stored hashed; after the one time you see it, all Tore can show you is the prefix and the last four characters.
Webhooks are signed, retried, and written down
Each delivery carries an HMAC-SHA256 signature over the exact body and the event name in a header. Three attempts with backoff, redirects not followed, addresses that are not publicly routable refused. Every attempt is kept with its status code and error, so you can look instead of guess.
The number that matters
3attempts
Fixed by the product, not by whoever is on shift.
What it means for you
You can build the part we did not build
The internal tool that matters to your team, the report shaped the way you think, the thing nobody else would ever ask for. It is a key and an afternoon, not a feature request and a wait.
Revoking a key is a decision, not an incident
A contractor leaves, a laptop goes missing, a script goes strange. You revoke that key, the rest carry on, and you know exactly what it could reach because you set the scopes when you made it.
You hear about things when they happen
The event arrives at your endpoint, signed, seconds after it occurred. Your five-minute cron and the queue of nothing it kept fetching can be deleted.
The honest limit: The public versioned API is still being opened up route by route. Today /v1 answers a version check and little else, so you can create and scope keys now, but most of what you will eventually call is not exposed on it yet.