Create the minimum access
Open Settings → Developers and create only the credential or webhook required for the integration. Name it for the system and owner so it can be rotated later.
Treat keys and signing secrets like passwords. Store them in a secret manager, never paste them into public tickets or browser code, and revoke them when the integration is retired.
Test safely
Use synthetic records and a company-controlled endpoint. Confirm authentication, event type, retry behavior, and idempotency before enabling production traffic. If a webhook fails, inspect its response and event ID; do not disable signature verification to make it pass.