> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firetone.com.au/llms.txt
> Use this file to discover all available pages before exploring further.

# The Developer section

> Keys, the console, the callback inbox, the request log and test numbers, in your panel.

**Developer**, in your panel's sidebar, is where you build against the API.
It's for organisation admins, and follows the organisation chosen in the
sidebar.

## API keys

Create **integration keys** from a preset, with the **IP addresses** they may
be used from. Each key shows when it was last used, from where, and the last
address it was refused from. Keys made before allowlists were compulsory are
flagged, with the addresses they've been seen using offered to allow. See
[Authentication](/api/authentication).

**Addresses** shows two things:

* your API's address, for example `https://api.firet.one/api/v1`;
* the addresses FireTone's webhooks and callbacks come from, to allow on your
  receiver.

## Console

Try any operation in the [public API](/api/reference) from your browser. This
replaces a Swagger page.

* **A form for each operation**, with its parameters and a starting request
  body.
* **The same request as `curl`**, so you can copy it into your code.
* **The response**, including the rate-limit headers and whether an
  `Idempotency-Key` answer was replayed.
* **Runs as you**, or as an API key you paste. A pasted key is kept on the page
  only. It then meets its IP allowlist from your browser's address, exactly as
  your integration would.
* **Calls and campaign starts run as a dry run by default.** Placing a real
  call needs a second tick. Even then, the console rings only your own
  extensions and **verified test numbers**, so trying the API never rings a
  customer.
* **Deletes need you to type `delete`.**

## Webhooks & callbacks

* **Your webhooks**, with the event picker, the delivery log, each delivery's
  exact body, and **Send again**.
* **The callback signing secret**, used for per-call `callback_url` and
  campaign `result_callback_url`. Create or rotate it here; it's shown once.

## Callback inbox

A URL that keeps whatever is posted to it for 24 hours: up to 200 requests of
up to 64 KB each.

1. Point a `callback_url`, a campaign's result URL or a webhook at it.
2. See each request's headers and body, and **which secret signed it**: your
   callback secret, a particular webhook, or none that matched.

It shows what your receiver will get before you've written one. The Node
verification snippet is beside it.

## Request log

Every request made with an API key for the last 7 days, including refused
ones, plus requests from the console. Each row shows:

* the method, path, status and error code;
* which key, and the address it came from;
* how long it took.

Filter to **errors** or to requests **refused by an IP allowlist**: the first
place to look when "the integration does nothing". Request bodies are never
kept.

## Test numbers

Up to five of your own phone numbers that the console may ring for real.

1. Add a number. A code is sent to it: by text if your organisation has an SMS
   account, otherwise by a call that reads the code out.
2. Enter the code to verify it. Codes last 15 minutes, and five wrong tries
   means sending a new one.