API & Webhooks

F1 exposes a REST API so you can read and write data programmatically. Webhooks let F1 push real-time events to your own systems.

API keys

Generate API keys from Settings → API Keys. Only owners and admins can create or revoke keys.

Click Create API key.
Give the key a descriptive name (e.g. CI pipeline, Zapier).
Click Generate. Copy the key immediately — it is shown only once.

Use the key as a Bearer token in the Authorization header for all API requests:

Authorization: Bearer f1_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Revoke a key at any time from the API Keys page. Revoked keys are invalidated immediately.

Rate limits

Authenticated API requests are limited to 60 requests per minute per API key. If you exceed this limit, the API returns a 429 Too Many Requests response.

The response includes X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers to help you manage your usage.

Webhooks

Configure webhooks from Settings → Webhooks. F1 sends an HTTP POST request to your endpoint URL whenever a subscribed event occurs.

Supported events:

Event	Description
`task.created`	A new task was created in any project
`task.updated`	A task's title, status, priority, assignee, or due date changed
`task.completed`	A task's status was changed to done
`task.deleted`	A task was permanently deleted
`project.created`	A new project was created in the organization
`comment.created`	A comment was posted on any task

Each webhook payload is a JSON object with event, timestamp, and data fields. The data field contains the full object that was created, updated, or deleted.

Webhook security

Every webhook request includes an X-Webhook-Signature header. This is an HMAC-SHA256 signature of the raw request body, signed with your webhook secret.

To verify the signature in your endpoint, compute HMAC-SHA256(secret, rawBody) and compare it (constant-time) to the value in the header. Reject requests where the signatures don't match.

// Node.js example
import crypto from 'crypto';

function verifySignature(secret, rawBody, signature) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  );
}

Your webhook secret is shown once when you create the webhook. Store it securely as an environment variable — not in source code.

Slack integration

F1 can post notifications to a Slack channel when tasks are created, updated, or completed.

In Slack, create an Incoming Webhook for your workspace at api.slack.com/apps. Copy the webhook URL.
In F1, go to Settings → Integrations.
Paste your Slack webhook URL and click Save.

F1 will immediately send a test message to your channel to confirm the connection. You can disable or update the Slack integration at any time from the Integrations page.