---
title: "Integrations and API pages"
description: "A map of the Integrations & API sidebar group: what each page does, who can open it, which credentials it mints, and which documentation page covers it."
canonical_url: "https://noxtica.com/docs/backoffice/integrations/"
markdown_url: "https://noxtica.com/docs/backoffice/integrations/index.md"
last_updated: 2026-10-27
published: 2026-10-27
section: "backoffice"
section_title: "Backoffice Guide"
site: "Noxtica"
language: "en"
source: markdown
---

# Integrations and API pages

The **Integrations & API** group of the Backoffice sidebar holds every page that connects Noxtica to your code and your tools: credentials, install snippets, event delivery, notifications and connections. A workspace Admin uses these pages. This page maps each one, so you know where to go and which guide covers the detail.

## What it is

Availability: Availability depends on your plan, role and the modules enabled for your organisation.

The group has 11 sidebar pages, all Admin in the sidebar. A twelfth credential page, **Coding Agent Keys**, sits in **AI & Agents** and is covered in [AI assistant, MCP tokens and coding-agent keys](https://noxtica.com/docs/backoffice/ai-assistant-and-mcp/).

| Nav label | Route | What it does | Covered in |
| --- | --- | --- | --- |
| Event Sinks | `/event-sinks` | Push verdict and audit events to a SIEM | [Event sinks](https://noxtica.com/docs/backoffice/event-sinks/) |
| API & SDK | `/api-config` | Server API keys and integration links | [Server API](https://noxtica.com/docs/api/), [Authentication](https://noxtica.com/docs/api/authentication/) |
| MCP Tokens | `/integrations/mcp-tokens` | Read-only tokens for an MCP client | [AI assistant, MCP tokens and coding-agent keys](https://noxtica.com/docs/backoffice/ai-assistant-and-mcp/), [MCP server](https://noxtica.com/docs/api/mcp/) |
| Score API Keys | `/integrations/score-api-keys` | Keys for server-side score calls | [Backend Integration](https://noxtica.com/docs/backend-integration/) |
| Script & Consent | `/integrations/script-consent` | Collector snippets, consent mode, protected actions | [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/) |
| Ingestion API Keys | `/integrations/ingestion-api-keys` | Keys for traces, metrics and logs | [APM and the ingestion service](https://noxtica.com/docs/observability/apm-and-ingest/) |
| Webhooks | `/integrations/webhooks` | Signed event delivery to your HTTPS endpoints | [Webhooks](https://noxtica.com/docs/api/webhooks/) |
| Alerts | `/integrations/alerts` | Email, Slack or webhook alerts | [Uptime checks, alerts, status reports](https://noxtica.com/docs/observability/uptime-alerts-status/) |
| Status Reports | `/integrations/status-reports` | Periodic email reports | [Uptime checks, alerts, status reports](https://noxtica.com/docs/observability/uptime-alerts-status/) |
| Relay Hostnames | `/integrations/relay` | Serve the collector from your own hostname | [Content Security Policy, hosts and first-party relay](https://noxtica.com/docs/sdk/csp-and-relay/) |
| Attestation Apps | `/integrations/attestation-apps` | Register Android and iOS apps | [Device and app attestation](https://noxtica.com/docs/security/attestation/) |
| Connectors | `/integrations/connectors` | Connect log providers, issue trackers, help desks and warehouses | This page |

The sidebar label for the server key page is **API & SDK**. Some older pages call it "API Config"; its page heading reads **API Configuration**.

## Prerequisites

- The Admin role. Lower roles do not see these pages, and the server checks the role on every read and every change. See [Backoffice guide](https://noxtica.com/docs/backoffice/overview/).
- An authenticator app. Creating, rotating and revoking a credential asks for a fresh MFA check.
- A place to store a secret. Every credential is shown once, when you create it. Backoffice cannot show it again.
- Some pages exist but depend on your plan or on a feature being enabled for your organisation, for example Score API Keys and Alerts. A page that is not available shows an empty or "not enabled" state, or a 404 on its API.

## Steps

### 1. Create a server API key (API & SDK)

1. Open `Backoffice → Integrations & API → API & SDK`. The tabs are **Client Integration**, **Backend Integration** and **Server API Keys**.
2. On **Server API Keys** select **Create API Key**.
3. Enter a **Key Name** (required), choose the narrowest **Scopes**, and select **Create Key**. The picker groups scopes as **Read access**, **Write access** and **Erase (destructive)**. A new key starts with `read:device` selected.
4. Copy the **Secret Key**. The page says "Save this secret key now — it will not be shown again."
5. To replace a key, select **Rotate** and type `ROTATE`. To retire it, select **Revoke** and type `REVOKE`. Revoking is permanent and requests that use the key fail at once.

Server keys start `sk_prod_`. Never put a secret key in browser code. Scope meanings, errors and limits are in [Server API](https://noxtica.com/docs/api/), [Authentication](https://noxtica.com/docs/api/authentication/) and [Errors](https://noxtica.com/docs/api/errors/).

### 2. Install the collector (Script & Consent)

Open `Script & Consent`. Tabs: **How it works**, **Snippets**, **Consent & extensions**, **Protected actions**, **CSP & storage**, **Check it works**. Pick a domain (the page keeps it in the URL as `?domain_id=`), copy its core script, choose how the domain receives consent, and name protected actions such as login or checkout. The public walkthrough is [Install & Browser Runtime](https://noxtica.com/docs/browser-runtime/). See also [Domains, site keys and the install card](https://noxtica.com/docs/backoffice/domains/).

### 3. Add a webhook

1. Open `Webhooks`. Tabs: **Manage** and **Integration** (an in-app developer guide).
2. Select **Add endpoint**, enter a public `https://` URL, choose the events and select **Add endpoint**. Localhost and private addresses are refused.
3. Copy the **Signing secret** when it is shown; it is shown once.
4. Select **Send test** to confirm your endpoint answers. Use **Enable**, **Disable**, **Rotate secret** and **Delete** as needed.

A workspace can hold up to 25 endpoints. Each attempt has a 5 second response timeout, and delivery is at least once, so a delivery can arrive more than once. Verify the `X-Noxtica-Signature` header on every delivery. The envelope, events and retry rules are in [Webhooks](https://noxtica.com/docs/api/webhooks/). Identity events are in [Identity verification events and webhooks](https://noxtica.com/docs/identity-verification-webhooks/).

### 4. Create MCP, Score and ingestion credentials

- **MCP Tokens** and **Coding Agent Keys**: see [AI assistant, MCP tokens and coding-agent keys](https://noxtica.com/docs/backoffice/ai-assistant-and-mcp/).
- **Score API Keys**: create a key for server-side score calls. Store it on your server, never in browser or app code. Calls made with any key count toward the workspace. Revoke keys you no longer use.
- **Ingestion API Keys**: create a key for one project and environment, add it to your telemetry exporter, and revoke it when the service is retired.

Each of these pages has a **Manage** tab and an **Integration** tab with an in-app guide.

### 5. Send events to your SIEM

Open `Event Sinks`. A new sink is created disabled. Arm it, then send a real test request. The steps are in [Event sinks](https://noxtica.com/docs/backoffice/event-sinks/).

### 6. Set up alerts and reports

- `Alerts` has the tabs **Channels**, **Rules**, **History** and **Escalations**. Add a channel (email, Slack or webhook), create rules that decide when an alert fires, and review the delivery history. A workspace can hold up to 10 channels and 20 rules. Alert evaluation depends on the feature being enabled for your organisation.
- `Status Reports` sends periodic emails about traffic, detection activity, usage and quota. Reports are on by default. Choose the frequency, the time zone and an extra contact, and preview the next report.

### 7. Serve the collector from your hostname (Relay Hostnames)

Choose the domain and a hostname on your own domain, add the DNS record the page shows (a CNAME and, for verification, a TXT record), then wait until it verifies. When it does, the collector loads from your hostname. Creating, verifying and revoking need MFA. A domain's **Relay** tab shows the same status read-only. See [Content Security Policy, hosts and first-party relay](https://noxtica.com/docs/sdk/csp-and-relay/).

### 8. Register mobile apps (Attestation Apps)

Add the app identifier for each Android and iOS app. Noxtica then accepts attestation results from that app. Remove an app to stop trusting its results. Registering needs MFA. See [Device and app attestation](https://noxtica.com/docs/security/attestation/).

### 9. Connect other services (Connectors)

Pick the service (log provider, issue tracker, help desk or data warehouse), enter its credentials, and save. Credentials are stored encrypted and never shown again. Remove or update a connection at any time.

## Verify it works

- A new credential appears in its page's list with a created time, and **Last Used** updates after its first call.
- A test webhook shows a success message with the response status and time.
- On Script & Consent, **Check it works** confirms the script reaches Noxtica.
- On Relay Hostnames, the status badge changes to `active` once DNS verifies.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| The page is missing from the sidebar | The role is below Admin | Ask a workspace Admin |
| A create or revoke action prompts for a code | Sensitive change needs a fresh MFA check | Enter the authenticator code |
| Lost a secret | Secrets are shown once | Rotate or recreate the credential |
| Webhook URL is refused | It is not public `https`, or points to localhost or a private address | Use a public `https` URL |
| A key returns 403 from the API | The scope does not cover the call | Create a key with the needed scope; see [Authentication](https://noxtica.com/docs/api/authentication/) |
| Score API Keys page is empty or its API returns 404 | Self-serve score keys are not enabled for your organisation | Ask your account team |
| Relay hostname stays unverified | The DNS record is missing or wrong | Check the CNAME and TXT values shown on the page |

## Related

- [Backoffice guide: navigation, roles and shortcuts](https://noxtica.com/docs/backoffice/overview/): where each page sits in the sidebar.
- [Event sinks](https://noxtica.com/docs/backoffice/event-sinks/): SIEM export.
- [AI assistant, MCP tokens and coding-agent keys](https://noxtica.com/docs/backoffice/ai-assistant-and-mcp/): MCP and coding-agent credentials.
- [Server API](https://noxtica.com/docs/api/): endpoints, scopes and errors.
- [Roles and permissions](https://noxtica.com/docs/security/roles-and-permissions/): who can manage credentials.