Developer Settings

How Lead360 helps

Developer Settings creates tenant-scoped private integration credentials for approved REST API and MCP operations. Each token is displayed once, bound to a sub-account, limited by selected scopes, rate controlled, auditable, and revocable so integrations can use Lead360 without inheriting a user password.

When to use this area

Use Developer Settings when an authorized agency owner needs to connect a controlled service or MCP client to documented Lead360 operations for one sub-account.

Before you begin

• Name the integration and owner.
• Choose only the production scopes required by the exact operations.
• Set an appropriate expiry and rate limit and prepare an approved secret manager.

Create access

1. Name the integration or service account clearly.
2. Grant the smallest scopes required.
3. Copy a newly issued secret once into an approved secret manager.
4. Never place secrets in templates, browser code, chat, logs, or memory files.

Validate the integration

1. Use the documented tenant and endpoint.
2. Test read operations before writes.
3. Use idempotency, validation, audit logs, and human approval for consequential actions.
4. Confirm errors do not leak credentials or cross sub-account boundaries.

Rotate or revoke

Rotate credentials when ownership or exposure changes. Revoke unused keys and verify scheduled jobs, webhooks, and dependent integrations stop or resume as expected.

Use Ask360 here

Ask360 can explain tenant-scoped endpoints, scopes, webhooks, idempotency, and safe test requests using masked identifiers. It never reveals an existing secret, accepts a secret in chat, creates broad credentials, runs an unapproved write, or crosses sub-account boundaries.

Confirm the result

A completed Developer Settings workflow should be visible in the product area that owns the final record. Use these checks before relying on the result or moving to the next customer-facing step.

• Copy the token once and test a read operation.
• Discover available operations and inspect confirmation requirements before writes.
• Rotate or revoke the token and confirm dependent jobs respond as expected.

Troubleshooting

A request returns unauthorized

Check bearer token formatting, expiry, revocation, tenant binding, and whether the token was copied completely.

An operation is forbidden

Compare the operation requirements with granted production scopes and current user authority. Arena-only and removed operations cannot be used in production.