Does Xoolink already offer a public API? Yes, as a read-only beta. An organization key can read its public profile, public opportunities, and public events with cursor pagination. Business writes, messages, quotes, and pacts are not exposed by this API. Slack and Yousign are managed for the organization; LinkedIn publishing is connected personally in Settings. Where do I configure an integration? For an organization, open its page and choose “Admin dashboard.” You can create an API key, connect Slack, register a signed HTTPS destination, or link Yousign there. Publishing to your LinkedIn profile is personal and is connected under Settings → Personal integrations. How are API keys protected? The full key is shown only when it is created. Xoolink stores only its SHA-256 fingerprint, never the clear secret. Each key has explicit permissions, expires after 30, 90 or 365 days, is rate-limited, and can be revoked immediately by a page administrator. Which permissions can an API key receive? Three permissions are available: organization:read reads the public projection of the organization tied to the key; opportunities:read reads public opportunities; events:read reads public events. A key receives only the permissions selected at creation, and the beta exposes no write permission. How do I call the API without exposing my key? Send Authorization: Bearer xool_live_… from your server, cloud function, or automation secret vault. Never place the key in browser JavaScript, a mobile app, a URL, a screenshot, or a Git repository. How do pagination and rate limits work? The opportunities and events lists return 20 items by default and up to 50. When meta.next_cursor is present, pass it unchanged as cursor to read the next page. Each key gets 120 requests per minute by default; X-RateLimit-* headers report the remaining allowance and a 429 response includes Retry-After. What is the difference between an API key and a webhook secret? An API key lets your system query Xoolink on demand: your system pulls data. A webhook secret verifies an event automatically pushed by Xoolink. They are separate secrets: a xool_live_… key never signs a webhook, and a whsec_… secret can never read the API. Which data is excluded from the public API? Organization profiles use an explicit allowlist that excludes billing, administrator access, sessions, and precise geographic coordinates. Discreet, withdrawn, demo, or amount-bearing needs are excluded from opportunities. For events, internal host identifiers, avatars, and announcement post IDs remain private. Messages, quotes, pacts, and personal data are not exposed. I lost or exposed my API key. What should I do? A lost key cannot be recovered because Xoolink does not retain its secret. Create a new key, replace the old one in your system, then revoke the former key immediately. An organization can keep up to five active keys so this rotation does not interrupt service. Who can manage an organization’s API keys and webhooks? Only administrators of its page, using a valid Xoolink session. Permissions are checked on the server for every read or change. Base includes 1 key, 1 webhook, and 1,000 API calls per month; Alpha includes 1 key, 2 webhooks, and 10,000 calls; Clan includes 5 keys, 10 webhooks, and 100,000 calls, with extended history and manual replay. Is there documentation that development tools can consume? Yes. The human-readable documentation includes curl examples, security rules, pagination, and errors. An OpenAPI 3.1 contract is also available at /api/v1/openapi.json to generate a client or import the definition into your tooling. Which webhook events are available today? Two public lifecycles are covered. Needs use need.created, need.updated, and need.withdrawn. Events use event.created, event.updated, and event.cancelled. A withdrawal or cancellation contains only the identifier, date, and stable link so a CRM can remove it without receiving the content again. Can confidential needs leave Xoolink through a webhook? No. Discreet, withdrawn and demo needs are excluded. An event is also blocked when Xoolink suspects an amount in the title, summary or description. Webhooks send no private pact, quote or personal message. Can I connect Slack, Teams, HubSpot or Notion? Yes. Slack has a guided two-click connection. Manual setup remains available, as it is for Microsoft Teams: paste the incoming-webhook or workflow URL and choose the language. For HubSpot, Notion, Zapier, Make, or your own server, use the signed standard JSON format. Yousign has its own electronic-signature connection. Are HubSpot and Notion native connectors? Not yet. The admin provides a guided recipe that preselects a read-only Xoolink API key and the public webhook lifecycles. A server-side relay, cloud function, or automation tool then verifies the signature and writes to HubSpot or Notion using that platform’s own authorization. Xoolink never asks for or retains your HubSpot or Notion key. How do I prevent duplicates in HubSpot or Notion? Keep data.id in a unique “Xoolink ID” field and upsert instead of always creating a record. Also deduplicate retries with X-Xoolink-Event-Id. The need.withdrawn and event.cancelled lifecycles should mark the record withdrawn or cancelled without rebuilding content that is no longer public. How do I send public needs to a Slack channel? This is not about your personal Slack account: you authorize Xoolink to post in ONE channel of your organization’s workspace. From the organization dashboard, an administrator clicks “Choose a Slack channel,” authorizes Xoolink, then selects the workspace and channel. Slack sends the destination directly to Xoolink, so there is no webhook URL to copy. Xoolink requests only the access needed for the chosen channel, retains no Slack OAuth token, and encrypts the destination URL. Once a channel is connected, the block reads “Slack is connected” and offers to add another. What does Xoolink send to Slack? The channel receives the public signals enabled by the administrator. Needs include creation, update, or withdrawal with a readable summary and requested expertise. Events include creation, update, or cancellation with date, location, and a Xoolink link. Discreet or demo needs, private messages, quotes, pacts, documents, and amounts are never sent. What is the LinkedIn connection for? It turns a public organization profile or shareable pack card into proof you can share with your professional network. The post links back to the matching Xoolink page to give visibility to an organization, alliance, or result. It does not synchronize the Xoolink and LinkedIn feeds. LinkedIn is connected: what happens next? On a public organization profile or shareable pack card, click LinkedIn. Xoolink first opens a preview with editable text, your identity, public visibility and the Xoolink link card. Nothing is sent until you explicitly click “Post now.” The post then appears publicly on your personal LinkedIn profile. Can Xoolink post automatically to my LinkedIn profile? No. Every post requires your explicit confirmation. Only the confirmed text, title, and public Xoolink link are sent to LinkedIn. Xoolink does not read your feed or contacts. Each submission is protected against duplicates after a double click or uncertain network response. Base keeps the regular LinkedIn share flow; connected publishing is included with Alpha or a Clan seat. What happens if I disconnect LinkedIn? Xoolink deletes your authorization and the encrypted token stored server-side. Posts already sent remain on LinkedIn and must be deleted from LinkedIn if you no longer want them. In Xoolink, the button then returns to the regular LinkedIn sharing flow without direct publishing. Can I publish as my organization’s LinkedIn Page? Not in this first version. It publishes only to the profile of the member who granted consent. Publishing as a Page requires a separate LinkedIn permission and an administrator role on that Page; Xoolink never assumes that authority. What is the difference between a Xoolink pact and a Yousign signature? The Xoolink pact records member consent and commitments inside the Pack. It must be sealed first. Yousign is an optional and separate legal step: after sealing, the lead can send the document to the same members from its organization’s Yousign account. Xoolink never signs or accepts a commitment on anyone’s behalf. How do I connect Yousign to an organization? An administrator opens the page dashboard, finds “Electronic signature,” then enters the environment, an API key, a template ID, and its ordered signer labels. Xoolink encrypts the key. The Yousign webhook must then be created with the URL and one-time secret shown by Xoolink. Start in Sandbox before switching to Production. Does every member need to connect their own Yousign account? No. An administrator connects the lead organization’s Yousign account once. When the document is sent, each signer receives a personal link by email and normally does not need a Yousign account. Depending on the template settings, Yousign may require email or SMS verification. When and by whom is the signature request sent? Only the Pack lead can start the request, after every positioned member has consented and the Xoolink pact is sealed. Xoolink validates the names, email addresses, and template placeholders, then creates the Yousign request. No document is sent or signed automatically on a member’s behalf. Who pays for and who can use electronic signatures? The Yousign connection is available to an Alpha administrator or a Clan organization. The organization uses its own Yousign subscription and signature credits, billed separately by Yousign. Members receiving a signature request need neither a paid Xoolink plan nor their own connected Yousign account. How do I verify that an event really came from Xoolink? Every request carries an HMAC SHA-256 signature in X-Xoolink-Signature. Verify it against the raw body with the secret shown at creation, compare in constant time and reject timestamps older than five minutes. The secret is displayed once and stored encrypted by Xoolink. What happens if my system is temporarily unavailable? An HTTP 2xx response received within eight seconds confirms delivery. Otherwise Xoolink retries with exponential delay, up to eight attempts. Your system should deduplicate retries with X-Xoolink-Event-Id; the log also lets an administrator replay a delivery. I lost or exposed my webhook secret. What should I do? Use “Replace secret” in the admin workspace, then immediately update the destination. The former secret stops working as soon as it is rotated. Use “Test” to confirm the new setup before waiting for a real event.