Keys — demo mode

Demo mode. Every figure and name here is display data. The screens are the same ones you will see, and the content is what gets built from your own business.

A key per use, and an event that reaches you the moment it happens

The key is shown once when created and never shown again — what we keep is its fingerprint, not the key. So whoever loses a key creates another and revokes the old one, and nobody — neither we nor you — can

API keys

API keys and their permissions
Name	Key	Permission	Last used	Case
Company website	nq_live_7f2a••••	Read only	8 min ago	Active
Accounting system	nq_live_c481••••	Read and write	Yesterday	Active
Developer sandbox	nq_test_19be••••	Read only	3 weeks ago	Idle

Revocation is immediate and irreversible 3 keys · 1 Idle

The webhook

Your URL that we call on every event

Receiving URL It must respond with 2xx within five seconds. And if it does not, we retry five times with increasing backoff and then stop — while the event stays in the log for you to pull whenever you like.

Send events to this URL Disabling stops the call, not the recording: events are stored and delivered when you re-enable it.

Signing secret We sign every payload withHMAC-SHA256 and send the signature in the X-Naateq-Signature header, formatted as t=…,v1=…. Verify against the raw payload not the parsed one — reordering the keys during parsing changes a single byte and a valid signature fails.

Available events

6 events

Webhook events and when each one fires
Event	When it fires
customer.qualified	The lead passed the qualifying questions and became serious
quote.sent	A quote was issued and reached the customer
contract.approved	You approved the contract — not the system
payment.link_sent	The payment link was sent on WhatsApp
payment.received	The instalment was confirmed by the gateway after re-verification
conversation.escalated	A conversation was escalated to you

Failed delivery attempts

Last 7 days

No failed attempt

Every event in the last seven days was delivered on the first attempt. And had one failed, it would appear here with its full payload and a resend button — because a lost event with no trace is worse than