Getting started
Authentication
How Vikk proves who it is when delivering leads, and how you authorize a CRM connection.
CRM authorization
Native CRM integrations are authorized through OAuth whenever the CRM supports it. You start the connection from the Vikk AI Ad Center integrations page, grant access through the CRM's OAuth flow, and Vikk receives a token that is stored securely and refreshed automatically. No API keys need to be copied or managed on your side.
Webhook signing
Outbound webhooks are signed using HMAC-SHA256. Each POST request includes an X-Vikk-Signature header prefixed with sha256=, an X-Vikk-Timestamp header with the Unix epoch seconds of dispatch, and an X-Vikk-Idempotency-Key header to detect duplicates.
To verify a webhook, capture the raw request body, compute the HMAC-SHA256 using your signing_secret, compare the signatures with a constant-time comparison, and validate that the timestamp is within a few minutes of the current time. See the Webhooks integration guide for the full header reference and an Express.js verification example.