Integrations and API pages

The Integrations & API group of the Backoffice sidebar holds every page that connects Noxtica to your code and your tools: credentials, install snippets, event delivery, notifications and connections. A workspace Admin uses these pages. This page maps each one, so you know where to go and which guide covers the detail.

What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

The group has 11 sidebar pages, all Admin in the sidebar. A twelfth credential page, Coding Agent Keys, sits in AI & Agents and is covered in AI assistant, MCP tokens and coding-agent keys.

The sidebar label for the server key page is API & SDK. Some older pages call it “API Config”; its page heading reads API Configuration.

Prerequisites

• The Admin role. Lower roles do not see these pages, and the server checks the role on every read and every change. See Backoffice guide.
• An authenticator app. Creating, rotating and revoking a credential asks for a fresh MFA check.
• A place to store a secret. Every credential is shown once, when you create it. Backoffice cannot show it again.
• Some pages exist but depend on your plan or on a feature being enabled for your organisation, for example Score API Keys and Alerts. A page that is not available shows an empty or “not enabled” state, or a 404 on its API.

Steps

1. Create a server API key (API & SDK)

1. Open Backoffice → Integrations & API → API & SDK. The tabs are Client Integration, Backend Integration and Server API Keys.
2. On Server API Keys select Create API Key.
3. Enter a Key Name (required), choose the narrowest Scopes, and select Create Key. The picker groups scopes as Read access, Write access and Erase (destructive). A new key starts with read:device selected.
4. Copy the Secret Key. The page says “Save this secret key now — it will not be shown again.”
5. To replace a key, select Rotate and type ROTATE. To retire it, select Revoke and type REVOKE. Revoking is permanent and requests that use the key fail at once.

Server keys start sk_prod_. Never put a secret key in browser code. Scope meanings, errors and limits are in Server API, Authentication and Errors.

2. Install the collector (Script & Consent)

Open Script & Consent. Tabs: How it works, Snippets, Consent & extensions, Protected actions, CSP & storage, Check it works. Pick a domain (the page keeps it in the URL as ?domain_id=), copy its core script, choose how the domain receives consent, and name protected actions such as login or checkout. The public walkthrough is Install & Browser Runtime. See also Domains, site keys and the install card.

3. Add a webhook

1. Open Webhooks. Tabs: Manage and Integration (an in-app developer guide).
2. Select Add endpoint, enter a public https:// URL, choose the events and select Add endpoint. Localhost and private addresses are refused.
3. Copy the Signing secret when it is shown; it is shown once.
4. Select Send test to confirm your endpoint answers. Use Enable, Disable, Rotate secret and Delete as needed.

A workspace can hold up to 25 endpoints. Each attempt has a 5 second response timeout, and delivery is at least once, so a delivery can arrive more than once. Verify the X-Noxtica-Signature header on every delivery. The envelope, events and retry rules are in Webhooks. Identity events are in Identity verification events and webhooks.

4. Create MCP, Score and ingestion credentials

• MCP Tokens and Coding Agent Keys: see AI assistant, MCP tokens and coding-agent keys.
• Score API Keys: create a key for server-side score calls. Store it on your server, never in browser or app code. Calls made with any key count toward the workspace. Revoke keys you no longer use.
• Ingestion API Keys: create a key for one project and environment, add it to your telemetry exporter, and revoke it when the service is retired.

Each of these pages has a Manage tab and an Integration tab with an in-app guide.

5. Send events to your SIEM

Open Event Sinks. A new sink is created disabled. Arm it, then send a real test request. The steps are in Event sinks.

6. Set up alerts and reports

• Alerts has the tabs Channels, Rules, History and Escalations. Add a channel (email, Slack or webhook), create rules that decide when an alert fires, and review the delivery history. A workspace can hold up to 10 channels and 20 rules. Alert evaluation depends on the feature being enabled for your organisation.
• Status Reports sends periodic emails about traffic, detection activity, usage and quota. Reports are on by default. Choose the frequency, the time zone and an extra contact, and preview the next report.

7. Serve the collector from your hostname (Relay Hostnames)

Choose the domain and a hostname on your own domain, add the DNS record the page shows (a CNAME and, for verification, a TXT record), then wait until it verifies. When it does, the collector loads from your hostname. Creating, verifying and revoking need MFA. A domain’s Relay tab shows the same status read-only. See Content Security Policy, hosts and first-party relay.

8. Register mobile apps (Attestation Apps)

Add the app identifier for each Android and iOS app. Noxtica then accepts attestation results from that app. Remove an app to stop trusting its results. Registering needs MFA. See Device and app attestation.

9. Connect other services (Connectors)

Pick the service (log provider, issue tracker, help desk or data warehouse), enter its credentials, and save. Credentials are stored encrypted and never shown again. Remove or update a connection at any time.

Verify it works

• A new credential appears in its page’s list with a created time, and Last Used updates after its first call.
• A test webhook shows a success message with the response status and time.
• On Script & Consent, Check it works confirms the script reaches Noxtica.
• On Relay Hostnames, the status badge changes to active once DNS verifies.

Troubleshooting

Related

• Backoffice guide: navigation, roles and shortcuts: where each page sits in the sidebar.
• Event sinks: SIEM export.
• AI assistant, MCP tokens and coding-agent keys: MCP and coding-agent credentials.
• Server API: endpoints, scopes and errors.
• Roles and permissions: who can manage credentials.