API keys and signed webhooks

Connect aide to your own tools. Owners and admins can now create API keys to call the aide API as the workspace, and add webhook endpoints that hear about new conversations, messages, status changes and order actions applied in your store as they happen. Both live under Settings > Developers.

How it behaves

Creating a key: give it a name, choose whether it may make changes or only read, and optionally an expiry date. The key is shown once; copy it then. aide keeps only a fingerprint.
What a key can do: read analytics and helpdesk settings, and read and change topics, scenarios, macros, knowledge and webhooks. It cannot see or reply to conversations, manage teammates, teams or billing, change helpdesk or widget settings, or create other keys. Those answer with a clear "API keys cannot call this endpoint" error.
Revoking a key: requests with it fail straight away. Expired keys stop working the same way.
Adding a webhook endpoint: a public https URL and the events to send (or all events, including ones added later). Private network addresses are refused. The signing secret is shown once.
Rotating the secret: the new secret is shown once, and for the next 24 hours every event is signed with both secrets so you can roll it out without dropping deliveries.
Failed deliveries: retried with growing delays for about 4 hours. An endpoint that keeps failing for a day is switched off and marked "Disabled after failures"; turning it back on resets the count.
Testing: "Send test event" delivers a sample event right away and shows the response, even to a disabled endpoint. Recent deliveries show each attempt's status, timing and response.
Agents see that developer settings are managed by owners and admins.

For developers

New: /v1/api-keys (list, create, revoke). Keys are aide_live_…, sent as Authorization: Bearer, with read and write scopes. Errors: 401 invalid_api_key, 403 api_key_not_allowed, 403 insufficient_scope. Rate limited per key. The OpenAPI spec lists apiKey under security for every operation a key may call.
New: /v1/webhook-endpoints (CRUD), POST /v1/webhook-endpoints/:id/secret (rotate), POST /v1/webhook-endpoints/:id/test-events, GET /v1/webhook-endpoints/:id/deliveries, GET /v1/webhook-event-types.
Events: conversation.created, conversation.updated (with previousAttributes), conversation.closed, message.created, order_action.applied (the order_action object, by a teammate or Aide); webhook.test from the test endpoint. Each body is { id, object: 'event', type, createdAt, accountId, data: { object, previousAttributes? } }.
Headers: Aide-Event-Id, Aide-Event-Type, Aide-Delivery-Attempt, and Aide-Signature: t=<unix seconds>,v1=<hex> where v1 is HMAC-SHA256 of ${t}.${raw body} keyed with the whole whsec_… secret. Accept if any v1 matches and t is within 5 minutes. Respond 2xx within 10 seconds; redirects are not followed. Deduplicate on the event id.

All changes