Appearance
Developers
The Developers tab holds what your help desk needs to send Overdesk real-time updates: a webhook endpoint address and a signing secret for each help desk you have connected. Without a webhook, Overdesk syncs on a schedule. With one, it reacts the moment a conversation is created or updated.
Open Settings → Developers. The tab is visible to owners and admins. Saving or generating a signing secret is included in the Pro and Scale plans and in the trial; see Plans and pricing.
What the tab shows
Under Webhooks there is one card for each connected help desk. If no help desk is connected yet, the tab says so: connect one first from Integrations, and its card appears here.
Each card shows:
- Whether the webhook is Configured or Not configured.
- The Endpoint URL, with a Copy button. This is the address you paste into your help desk's webhook settings, where some help desks call it the callback or payload URL. It is not a Help Scout app's Redirection URL.
- Once configured, how many events have arrived and when the last one came in.
- The Signing secret field, with Save and, once a secret is stored, Remove.
Setting the signing secret
The signing secret proves that an event really came from your help desk. Which side creates it depends on the help desk.
| Help desk | Who creates the secret | What you do |
|---|---|---|
| Help Scout | You. Help Scout asks you to invent one. | Click Generate a secret on the Help Scout card. Copy the secret it shows, then paste it into the secret field of your webhook in Help Scout and save there. |
| Zendesk and Intercom | The help desk, when you create the webhook. | Copy the secret your help desk shows you, paste it into Signing secret and click Save. |
| FreeScout | FreeScout. | Paste FreeScout's secret into Signing secret and click Save, then connect FreeScout again from Integrations. Overdesk registers the webhook on your FreeScout for you. |
A generated secret is shown once. Overdesk starts using it immediately, so paste it into your help desk before you leave the page, or events will arrive unsigned and be rejected.
A secret needs at least 16 characters, and it must never contain any part of the endpoint URL: anyone who has seen that address could then forge events. Overdesk refuses a secret that breaks either rule, and warns you on the card if the stored one is too easy to guess.
For the steps inside each help desk, see Real-time updates with webhooks.
Replacing or removing a secret
On the Help Scout card, Replace with a new secret issues a fresh one. Overdesk verifies against the new secret straight away, and the old one stops working the moment you continue, so every event Help Scout sends is rejected until you paste the new secret into the webhook there too.
Remove deletes the stored secret. Overdesk stops accepting real-time events from that help desk and falls back to scheduled syncing. Removing a secret works on every plan.
What Overdesk checks
Every event is signature-verified before Overdesk accepts it, and an unsigned or mismatched event is rejected. Scheduled syncing keeps running alongside webhooks as a safety net, so a webhook speeds Overdesk up and is never something it depends on.
Real-time drafts follow the same Allowed inboxes setting as scheduled ones. See Allowed inboxes.