Team, API Keys & Webhooks

These three settings pages live under Admin → Settings and govern who can operate your project and how outside systems integrate with it. Team controls human access, API keys control machine access, and Webhooks push your project's events out to your own infrastructure.

Team

Open Settings → Team to see everyone who can access your project's admin surface, their role, and whether they've accepted yet.

Inviting a teammate

Enter the teammate's email, pick a role, and click Send invite.

The invite emails the teammate a link to the admin dashboard. Email is best-effort: if the send fails, the membership is still created and the teammate can sign in to pick it up.

Roles

Every teammate holds exactly one role. Roles are ranked Owner > Admin > Member > Viewer — you can only assign or modify roles strictly below your own.

Changing a role or removing someone

In the member list, change a teammate's role with the inline role selector, or click Remove to revoke their access immediately. A few guardrails apply:

• You can't change or remove yourself — a second Admin or the Owner has to do it. This prevents locking the project out of its last operator.
• You can't touch the Owner — that's a support-only operation.
• You can only act on teammates strictly below your own role, and you can't promote anyone to your own role or higher.

Every invite, role change and removal is written to the Audit Log.

API keys

API keys let scripts, backend services and CI call Onsend on your project's behalf without a human session. Open Settings → API keys (requires Admin) to mint and manage them.

Webhooks

Webhooks push your project's events to a URL you control, so your own backend can react in real time. Open Settings → Webhooks (requires Admin) to register endpoints.

Event types

Events are project-level activity you opt into per endpoint. Common ones:

Verifying the signature

Every delivery is a POST with a JSON body and these headers:

To verify, compute the HMAC-SHA256 of the raw request body with your secret and compare it (in constant time) to x-vandergrid-signature:

import { createHmac, timingSafeEqual } from "node:crypto";
 
function isValid(rawBody: string, signature: string, secret: string): boolean {
  const expected = createHmac("sha256", secret).update(rawBody, "utf8").digest("hex");
  if (expected.length !== signature.length) return false;
  return timingSafeEqual(Buffer.from(expected, "hex"), Buffer.from(signature, "hex"));
}

Delivery & retries

A successful delivery is any 2xx response. Onsend does not follow redirects — your endpoint must respond directly. Anything else (a non-2xx, a timeout, a connection error) is treated as a failure and retried with exponential backoff:

After 8 failed attempts the delivery is marked given up and no longer retried. Make your receiver idempotent — a delivery can legitimately arrive more than once (e.g. when your endpoint 2xx's but the connection drops before Onsend records it).

This page covers the dashboard surfaces. The full per-endpoint REST reference — every route, request shape, scope and event payload — is documented separately: see the API Reference (coming soon).