The Owner manages Integrations for the real site with recent Accounts second-factor verification for changes. These controls configure read-only service access and outgoing event delivery. They do not give a remote system permission to register, reserve, cut or dispose of pieces, and an outgoing event does not prove a stock adjustment elsewhere.
Issue a restricted read credential
Open Integrations and use Issue a credential. Give it a meaningful Name identifying the receiving system. Select What it may read, choose Expires after and Requests a minute, and review the site's displayed active-credential and request budgets. The supported scopes read pieces or events. Expiry is from 1 to 365 days and a credential's rate is from 1 to 600 requests a minute; the site can hold at most ten active unexpired credentials.
Choose Issue the credential and use Copy the new token now. It is shown once. Store it in the intended system's secret store rather than an ordinary document or URL. A lost token is revoked and replaced; the page cannot reveal it again. Credentials belong to this site and do not represent a person's product role.
Use Credentials to check scope, expiry, state and last use. Last use is an operational hint, not an exhaustive request audit. Revoke an unnecessary or compromised credential with a factual reason. Where commercial checks apply, current integration entitlement is required as well as a valid credential. Detailed API implementation belongs to the integration contract, rather than an interactive stock procedure.
Allow the destination before subscribing
In Webhooks, review Allowed destinations. Enter the receiving system's HTTPS Origin and choose Allow this destination. The destination must resolve to allowed public addresses. Establish the genuine receiving address with its administrator; changing it to an unrelated service is not a remedy for a refusal.
Under Subscriptions, enter Name and URL on an allowed destination, choose the required Events and Subscribe. The subscription begins with new events. It does not send retained history automatically. Copy the new signing secret from its one-time display and arrange its secure use at the receiver. A token for the read API and a webhook signing secret have different purposes.
Inspect the site's sending notice. A subscription can collect events while sending is off, and creating one does not establish that delivery is enabled or the receiver accepted anything. The page's recorded deliveries are the evidence for that question.
Maintain a subscription deliberately
Pause and Resume control the selected subscription. Issue a new signing secret rotates its signing basis; coordinate the receiver's current configuration and inspect the resulting key identity. Revoke records a reason and ends that subscription. Removing an allowed destination also requires its reason. Read each resulting state before concluding that delivery has resumed or stopped.
Needs a person lists parked, retained or withheld deliveries. The ordinary worker retries retryable delivery failures for up to 24 hours from the first attempt; a receiver refusal requires attention. Check the address, receiver and visible reason before deciding what to do. Do not describe a queued or attempted delivery as confirmed downstream processing.
Review a replay before sending events again
Use Send events again for one subscription. Choose Everything parked, retained or withheld or A range of events, then enter the exact first and last event references where applicable. Choose Preview, inspect its counts and range, acknowledge I understand the receiver will get duplicates, and give a reason of at least ten characters before Send again. A replay contains at most 1,000 events.
The same event identities and bodies are retained, so the receiver must recognise duplicate event IDs. A replay is an explicit delivery decision, not a new physical stock event or a way to bypass stopped disclosure. If the preview is refused or the subscription is revoked or held, resolve that current condition before another request.
For piece interpretation, use History and state. For private records leaving the service, use Exports and closure.