Settings

Manage your profile, integrations and subscription.

Where: left nav → Settings.

Account

Under Settings → Account you can edit your Full name and start a secure Change email flow (email changes require verification). Click Save changes.

Integrations

Under Settings → Integrations.

Google Calendar

Connect Google Calendar so agents can book appointments.

1. Click Connect Google Calendar and authorize access (the platform uses the Calendar scope only, under Google’s Limited Use policy).
2. Once connected, set:
   • Auto-confirm Appointments.
   • Send Reminders + how long before (15 min – 1 day).
   • Default Timezone — a fallback; actual working hours live on each resource.
3. Save Changes. Use Disconnect to remove it (existing appointments are unaffected).

Slack

Send notifications to Slack. Add one or more integrations (admin only), each with a webhook URL and a choice of events: Call Completed, Call Failed, Appointment Booked, Campaign Completed, Usage Warnings and a Daily Summary (with a send time). Use Test to post a sample message.

Billing

Under Settings → Billing (visible on directly-billed accounts). See Billing & Plans for the plan overview. From this page you can:

• View usage — agents and minutes used against your plan, and your current period end.
• Manage Billing — open the Stripe customer portal to update your payment method or invoices.
• Buy Minute Packs — purchase prepaid minutes (they never expire); the balance updates once the payment is confirmed.
• Auto Top-Up — automatically buy a pack when your balance drops below a threshold. Set the pack, threshold (minutes) and a monthly purchase cap. If a charge needs 3‑D Secure it pauses; after repeated failures it disables itself.
• Change plan — upgrade or downgrade from the plans grid. Upgrades/downgrades show an estimated proration before you confirm; downgrades are scheduled for the period end (and can be cancelled).

Payment method

Auto top-up needs a saved card. If you don’t have one yet, buy a minute pack once — that saves your card for future automatic top-ups.

Webhook allowlist

Under Settings → Webhook Allowlist (admin/owner only). Restrict which hosts your custom tools and MCP servers may call: enter one hostname per line (no scheme or path; subdomains match by suffix). An empty list allows any URL. Private/local hosts are rejected. Click Save allowlist.

Webhooks

Under Settings → Webhooks (if enabled for your plan). A webhook is an account-level object: you define the receiving endpoint once and attach it to any number of agents; the platform then POSTs a JSON payload to it on the call events you pick. Anyone can view the list and the delivery history; creating, editing, deleting, testing, resending and secret actions are admin/owner only. Up to 25 webhooks per account.

Create a webhook

Click New webhook and fill in:

• Name — unique within your account.
• Endpoint URL — HTTPS only. Private/local hosts are rejected, and if a webhook allowlist is set the host must be on it.
• Authentication — the Authentication type is HMAC signature by default (see Verify the webhook signature); the others are None, Bearer token, API key, Basic auth, OAuth2 client credentials and JWT bearer. Need a gateway token and a signature? Keep HMAC and add an Authorization header under Headers.
• Headers — sent with every delivery; reference a secret as {{secrets.KEY}} from the insert-secret menu (values are encrypted and never shown again).
• Timeout (seconds) (1–120, default 15) and Retries — Max retries (0–4) and Retry on: timeouts/connection errors, server errors (5xx), 429 and 408. See Delivery retries.
• Events — Call completed (on by default), Call started, Call failed, Call transferred, Appointment booked. Each event is a separate delivery.
• Include in payload — Summary & analysis, Full transcript, Formatted transcript, Extracted variables, Input variables, Campaign/contact info, Transfers, Call metadata, Recording URL. Disabled sections are omitted from the payload.
• Only answered calls — skip Call completed for calls that ended without being answered.
• Enabled — a disabled webhook stays attached to its agents but receives nothing.

When you save a webhook with HMAC authentication its signing secret (whsec_…) is shown once — copy it into your receiver right away.

Attach webhooks to agents

Open an agent → Settings tab → Webhooks card and tick the webhooks that should fire for its calls (up to 5 per agent; the card also links to Manage webhooks and Create a new webhook). One webhook can serve many agents — every payload carries the agent_id.

An agent still on the old per-agent configuration shows This agent uses a legacy webhook; migration pending. with a read-only summary: deliveries keep using those settings until the migration completes, and once you select a webhook on the card only your selection is used.

Test and delivery history

• Send test delivers a sample Call completed payload using the saved configuration (unsaved changes are not included); with HMAC the test is signed, so save the webhook first.
• The Delivery history tab lists every delivery of the webhook — event, status (pending / delivered / failed), HTTP response, each attempt and the stored payload — filterable by event, status and agent, kept for 30 days. Admins can click Resend on a delivery: the same event is queued as a new delivery (a truncated payload is rebuilt from the call). An agent’s own Webhook history tab shows the same rows across all of its webhooks.

Delivery retries

The first attempt goes out immediately. When it fails with a retryable outcome — a timeout/connection error, a 5xx response, 429 or 408 — the delivery is retried up to Max retries times (at most 4), waiting 30 s, 2 min, 8 min and 30 min after the previous attempt, each wait with up to 10 % random jitter. Any other 4xx response is final: no retry. Every attempt lands on the same row in the Delivery history; while a retry is scheduled the row stays pending and shows Next attempt with the time of the next try. Agents still on a legacy per-agent webhook keep the old retry behaviour until they are migrated.

Auto-disable

After 10 consecutive failed deliveries, if the webhook has never delivered successfully or its last successful delivery is older than 7 days, the platform disables it:

• the list and the webhook’s page show the Auto-disabled badge with the reason;
• admins and owners receive an e-mail (webhook name, endpoint host, failure count, last success);
• new events are no longer delivered to it, and Resend returns an error while it stays disabled.

To recover, fix the receiving endpoint, click Re-enable on the webhook (this also resets the failure counter), then resend the failed deliveries from the Delivery history.

Signing secret

Admins can Reveal (and Copy) the secret from the webhook’s Signing secret card — every reveal is written to the audit log — and Regenerate secret. Regeneration is immediate: the old secret stops working the moment you confirm, and deliveries fail until the receiver uses the new one — update the receiver first, then resend the failed deliveries from the history.

Verify the webhook signature

Every request from an HMAC webhook — each attempt, retry, resend and Test — carries the header

X-Webhook-Signature-256: t=<unix seconds>,v1=<hex>

where v1 = HMAC-SHA256(secret, "<t>." + raw body). The body is compact JSON sent as bytes, so compute the HMAC over the raw request body — a parsed-and-re-serialized body will not match (Express: express.raw({ type: "application/json" }), Flask: request.get_data()). Your receiver should:

1. Parse t and v1 from the header.
2. Recompute the HMAC over "<t>." + body and compare it with v1 using a constant-time comparison.
3. Reject the request if t is older than 5 minutes — every attempt is signed with a fresh timestamp, so a stale one is a replay.
4. Dedupe on the payload’s delivery_id — retries and resends can deliver the same event more than once.

Python

import hashlib, hmac, re, time

SIGNATURE = re.compile(r"^t=(\d+),v1=([0-9a-f]{64})$")

def verify(secret: str, header: str, body: bytes, tolerance: int = 300) -> bool:
    m = SIGNATURE.match(header or "")
    if not m:
        return False
    t, v1 = m.group(1), m.group(2)
    if abs(time.time() - int(t)) > tolerance:  # 5-minute replay window
        return False
    expected = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, v1)

Node

const crypto = require("node:crypto");

function verify(secret, header, rawBody, tolerance = 300) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header || "");
  if (!m) return false;
  const [, t, v1] = m;
  if (Math.abs(Date.now() / 1000 - Number(t)) > tolerance) return false; // 5-minute replay window
  const expected = crypto.createHmac("sha256", secret).update(`${t}.`).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(v1, "hex"));
}

Roles

Members have one of three roles — user, admin or owner — which control who can edit integrations, webhooks, the webhook allowlist, and use templates. New members join via an emailed invite link.