Integration surfaces

Bynefit connects in more ways than one API. Find what you want to do, and the page that covers it, the credential it needs, and whether it is ready today.

I want to…

I want to…	Use	Credential	State
Read community resources	Resources: read	Developer key	Available
Propose a new resource	Resources: submit	Developer key	Available
Keep my own directory in sync from a spreadsheet or system	Resources: manage	Space key, with approval	By approval
Read my Space's activity, forms, payments or tasks from my server	The Read API, with a Space key	Space key	Available
Be told the moment something happens	Webhooks	Signing secret	Available
Let people sign in with their Bynefit account	OAuth 2.0 / OpenID Connect	A sign-in client (no secret)	Available
Show my group on a website	Embed widget	Space key, with allowed websites	Available
Show events, resources or media, and take forms, on a hosted site	Hosted sites API and the hosted sites guide	None (the site's slug)	Available
Let a client see their own engagements, documents and messages on my site	Client portal API	The client's sign-in token	Available
Run a practice's pipeline from its own admin page	Client portal API, practice routes	A manager's sign-in token	Available
Report a WordPress site's health and visits	Site host API	Site key, signed	Available
Send my product's events as a partner	Partner events	Partner key, signed or registered website	By approval
Set up everything as a partner	Partner integration guide	All of the above	By approval
Read engagements with an API key or a webhook	Not available today	None	Planned
Read a hosted site's shop, products or orders through an API	Not available today	None	Planned
Download a machine-readable API description	Not available today	None	Planned
Hand the docs to an AI agent	Building with an AI agent	Whatever the page you hand over needs	Available
Let an AI agent read my Space	Agent keys	Agent key	Available
Connect with no code	No-code and automation tools	Signing secret	Available

The credentials, side by side

Credential	Looks like	Made at	Safe in a browser?
Developer key	`bapi_pk_…`	/dash/developers/keys	No. It is yours; keep it out of pages you publish.
Space key	`bapi_tk_…`	/dash/integrations/api-tokens	No, except a key that holds only the widget permission and is locked to your websites.
Agent key	`bapi_ag_…`	/dash/integrations/agent-keys	No. It is refused anywhere but the Authorization header.
Webhook signing secret	`whsec_…`	/dash/integrations/webhooks	No
Sign-in client id	`site_…`	/dash/sites/oauth	Yes. It is public by design and the flow uses PKCE.
Signed-in person's token	a long JWT	By signing in	It lives there, so keep scripts on the page trusted.
Site key	`bynli_sh_…`	The site's settings, WordPress tab	No
Partner key	`pbk_…`	The partner console	Yes. It only says who you are.
Partner signing secret	a long random string	Issued once by Bynefit	No
Older widget key	`wk_…`	/dash/integrations/embeds	Meant for pages, but were switched off on 20 October 2026. See Migrating from the legacy endpoint.

Where each one runs

Surface	Called by	Who can set it up
Read API	Your server	Anyone, for a developer key. A manager or admin, for a Space key.
Webhooks	Bynefit calls your server	A Space admin
Sign in with Bynefit	The visitor's browser, or your app	A Space manager or admin
Embed widget and the Embeds hub	The visitor's browser	A Space admin
Hosted sites runtime	The visitor's browser	The site's owner
Client portal	The signed-in person's browser	A manager of the practice's Space
Site host API	The WordPress server	A Space admin
Partner events	The visitor's browser, or your server	Bynefit, with you as a partner

Retiring

The ?key= endpoint and employee tokens were switched off on 11 October 2026, and older widget keys were switched off on 20 October 2026. Each has a current replacement in the tables above. See how to switch.