In brief
-
Go to Applications > Developer resources > Integrations.
-
Find the blocked webhook in the list, open the Menu (≡), and select Edit.
-
Copy the new secret key from the Webhook to call REST API field and update your local app or integration with it.
In detail
When you create a webhook, a secret key is automatically generated, which opens access to your data in Bitrix24. Keep the secret key confidential and avoid using it in any webpage code or script. Bitrix, Inc. blocks webhooks that have a secret key or token in the public domain.
How to know if your webhook is blocked
If you see the INVALID_CREDENTIALS error, it means your webhook is blocked. Bitrix, Inc. can limit access to the REST API for data protection, according to clauses 4.2. and 21.3.1. of the Terms of Service.
Bitrix24 Terms of Service
To reactivate your webhook, generate a new secret key.
The INVALID_CREDENTIALS error also occurs if the webhook with the specified address is missing. This can happen if:
- The webhook was deleted.
- The secret key was changed.
- The owner of the webhook changed.
- There was a mistake in the webhook address or ID.
How to get a new secret key
When a webhook gets blocked, a new secret key is generated. Here's how to find it:
-
Go to Applications > Developer resources > Integrations.
-
Find the blocked webhook in the list, open the Menu (≡), and select Edit.
-
Copy the new secret key from the Webhook to call REST API field and update your local app or integration with it.
If you want to change the webhook's owner, update the secret key. Click Generate new > Continue and save your changes.
