In Settings › API Access, you make personal access tokens, so a script or an MCP client can use Dvina as you. Admins also add webhooks there, to send the Livespace's events to their own systems.
API Access comes with the Enterprise plan. Every member can make their own tokens; only owners and admins see Webhooks.
Create a token
- Open Settings and choose API Access.
- Under Personal Access Tokens, choose Create Token.
- Enter a Name, so you know later what uses it.
- Choose the Access: Read only or Read and write.
- Choose when it Expires: In 30 days, In 90 days, In 365 days or Never expires.
- Choose Create Token.
- Under Copy Your Token, copy the token and keep it somewhere safe. This is the only time it's shown.
A token works as you, in the Livespace you made it in, with your role there now. A Read only token can read but can't add or change anything.
To use a token with an MCP client, see Connect with an API key instead of OAuth.
Check, rotate or revoke a token
Your tokens are listed under Personal Access Tokens with their access. Choose one to see what Starts With, its Access, when it was Last Used and when it Expires.
- To replace a token, choose Rotate…, then Rotate to confirm. A new token replaces it, and the old one stops working at once. Copy the new token under Copy Your Token.
- To stop a token, choose Revoke…, then Revoke to confirm. Anything that uses it stops working at once.
Making, rotating and revoking a token is recorded in the audit log.
Add a webhook
A webhook sends the Livespace's events, the same records as the audit log, to an address you choose.
- In Settings › API Access, under Webhooks, choose Add Webhook.
- Enter a Name and the URL. Use a public HTTPS URL.
- Under Events, leave it empty for every event, or list actions and areas, such as
member.addedorsharing.*. - Choose Add.
- Under Copy the Signing Secret, copy the secret. This is the only time it's shown.
If Dvina says This address can't be reached from Dvina, use a public HTTPS URL.
Check each request's signature
Dvina sends events in batches, as JSON, and signs every request. Use the signing secret to check that a request came from Dvina:
- Each request has an
X-Dvina-Signatureheader liket=<timestamp>,v1=<signature>. - The signature is an HMAC-SHA256, in hex, of the timestamp, a period, and the request body, made with your signing secret.
- Compute it yourself and compare. Reject a request whose signature doesn't match or whose timestamp is too old.
Check or change a webhook
Your webhooks are listed under Webhooks with their status: On, Paused or Failing. Choose one to see its details.
- To change it, edit its Name, URL or Events, then choose Save.
- To pause it, turn off Send Events. Turn it on again to start sending again.
- To see how it's doing, check its Status and how many events were Sent. A failing webhook shows its Last Error. Dvina keeps trying, and records the failure in the audit log.
- To change its secret, choose New Signing Secret…, then confirm. Requests are signed with the new secret at once, so update the receiver right away.
- To remove it, choose Delete…, then Delete to confirm. Nothing more is sent to it.