Run your community from your own tools

A public join page is the right front door for people. It is a poor front door for a script. If your membership already lives in a CRM, a Slack workflow, or a small service you wrote, copying names into the dashboard by hand is the part that rots first.

Pro now includes a customer API. You create a key, call Inviter from your own system, and optionally receive a signed webhook when an invitation or an applicant changes.

What you can do

The key belongs to the community, so the URLs do not include a community id. Send it as Authorization: Bearer inv_live_….

Invitations. These are the same join requests you already see in the dashboard.

• send stores an approved invitation and delivers the platform invite in that call. Use this when your system has already decided the person should get in.
• submit follows your join form: required fields, auto-approval, and email verification. reCAPTCHA and country checks stay on the public page, because the caller is your server, not the visitor’s browser.

You can list, fetch, edit, approve, reject, delete, and retry a failed delivery. An invitation can only be edited while it is pending or waiting on email verification. The email address stays fixed after create.

Events and applicants. List and edit events, and create, update, or delete applicants. Read the event first so answers use the field ids on that event’s form.

The join form. One form per community. Read it before you submit an invitation so answers are keyed by field id, not by a label you hoped would match.

Create calls for invitations and applicants accept an Idempotency-Key header. You invent that value — a UUID from uuidgen or crypto.randomUUID() is the safe choice — and you store it. If the call times out and you send the same key again within 24 hours, you get the original record back instead of a second person. The API guide walks through this slowly, because it is easy to skip and then create duplicates.

Keys

Open API in the community dashboard. Only the owner sees that page.

Give the key a name you will recognize later, such as “Production” or “Nightly import”. The secret is shown once. Copy it then. We store a hash, so we cannot show it again. If you lose it, delete the key and create another.

You can hold several keys. Each one can call the full API. There is no read-only key. Deleting a key stops it immediately. A script using the old secret gets “API key was deleted”, which is different from a key that never existed.

Each key allows 120 requests a minute. A community can have up to 20 active keys.

Webhooks

One HTTPS URL per community. Saving it returns a signing secret, also shown once. Saving again replaces that secret. Clearing the URL stops delivery.

We POST a JSON object when an invitation moves through its life — created, awaiting verification, approved, delivering, sent, delivery failed, rejected, deleted — and when an applicant is created, updated, or deleted. Saving an event or the join form does not send a webhook. Dashboard actions, the public page, and the API all emit the same events.

The body is not the only thing to trust. Each request includes:

• X-Inviter-Timestamp — seconds
• X-Inviter-Signature — lowercase hex HMAC-SHA256
• X-Inviter-Event-Id — the same id on every retry of that delivery

The signed text is the timestamp, a period, then the raw body. Do not parse the JSON and print it again. Do not hex-decode the signing secret. The guide has a worked example and the same steps in Node.js, Python, and Go. Reject timestamps more than five minutes from your clock.

Delivery is at least once. A 2xx within five seconds is success. Anything else, including a redirect, is retried: 1 minute, 5 minutes, 30 minutes, 2 hours, 8 hours, then 24 hours. Retries reuse the event id. Order is not guaranteed, so when a record includes updated_at, trust that over arrival order.

The API page also keeps the latest 50 delivery attempts: status, event, and error. The request body is not shown there.

What Pro changes

The API is part of Pro, at $19.99/month or $191.90/year. Free communities keep the public page, the dashboard, and ticket sales. They do not get keys or webhook delivery.

If you later leave Pro, deliveries stop and you cannot create a key or save a webhook URL. You can still delete a leftover key or clear the URL so nothing is left pointing at a server you no longer want us to call.

Where to start

1. Upgrade the community to Pro if it is not already.
2. As the owner, open API in the dashboard and create a named key.
3. Read the API guide before the first POST. The invitation and applicant bodies are picky about where the answers go, and the guide shows a full example for each call.
4. If you want events pushed to you, save an HTTPS URL and verify X-Inviter-Signature before you trust the body.