Integrations

RoadmapForge API keys and webhooks

Business workspaces can generate API keys for the current read-only REST API and create outbound webhooks for real-time event delivery. This page explains what is available today, how it works, and where the boundaries still are.

If your workspace is still on Free, open Plans in the dashboard and request Business access for founder-led setup.

Availability

Business plan

API scope

Read-only boards and posts

Webhook delivery

Signed POST requests

API keys

Server-side access for reading workspace feedback data.

API keys are meant for trusted backend integrations that need to read workspace boards and posts without using a browser session. Each successful key-authenticated request updates the key's `lastUsedAt` timestamp in Settings.

Sync boards and posts into an internal admin panel or support workspace.

Pull feedback data into reporting, BI dashboards, or product review docs.

Give backend jobs read access without sharing a user session cookie.

Authentication header

Send your key in the `x-api-key` header. Keys should stay on trusted servers and should never be exposed in public client-side code.

x-api-key: rf_live_your_secret_here

GET/api/v1/boards

Returns all boards for the workspace attached to the API key.

GET/api/v1/posts?boardId=<board-id>&sort=votes

Returns posts for one board. Supports `votes`, `newest`, and `oldest` sorting.

List boards

curl -H "x-api-key: rf_live_your_secret_here" \
  https://roadmapforge.vercel.app/api/v1/boards

List posts for one board

curl -H "x-api-key: rf_live_your_secret_here" \
  "https://roadmapforge.vercel.app/api/v1/posts?boardId=BOARD_ID&sort=votes"

Current API boundary

The key-authenticated API is intentionally read-only right now. Write actions such as creating posts, voting, moderating, or deleting resources still require a signed-in workspace session in the product UI.

Webhooks

Signed outbound events for keeping other systems in sync.

Webhooks deliver workspace events to your own endpoint as signed `POST` requests. Each webhook is configured in Settings with a destination URL, an event list, and a secret that is shown once when the webhook is created.

Notify Slack, Discord, or email automation when new requests arrive.

Open follow-up work in your own backend when comments or votes change.

Keep a CRM, warehouse, or feature-tracking workflow in sync in near real time.

Delivery format

Content-Type: application/json
X-RoadmapForge-Event: the event name
X-RoadmapForge-Signature: HMAC SHA-256 of the raw body using your webhook secret
Request body shape: {"event","data","timestamp"}

Example webhook body

{
  "event": "comment.created",
  "data": {
    "postId": "clx123...",
    "commentId": "clx456...",
    "author": "Alex Admin",
    "body": "We need this on the roadmap."
  },
  "timestamp": "2026-03-27T10:15:30.000Z"
}

EVENTpost.created

Sent when a new feedback post is created.

EVENTpost.updated

Sent when a post title, body, board, or status is updated.

EVENTvote.added

Sent when a signed-in user adds a vote to a post.

EVENTvote.removed

Sent when a signed-in user removes a vote from a post.

EVENTcomment.created

Sent when a new comment or reply is created.

EVENTstatus.changed

Sent when a post moves between statuses.

Node.js signature verification

import crypto from "crypto";

const rawBody = requestBodyAsString;
const secret = process.env.ROADMAPFORGE_WEBHOOK_SECRET;
const received = req.headers["x-roadmapforge-signature"];

const expected = crypto
  .createHmac("sha256", secret)
  .update(rawBody)
  .digest("hex");

const isValid = crypto.timingSafeEqual(
  Buffer.from(received || "", "utf8"),
  Buffer.from(expected, "utf8")
);

Current webhook boundary

Deliveries are sent immediately and signed correctly, but the product does not yet provide retry history, replay controls, or a delivery log UI. If your endpoint is down, you should log and handle retries on your side for now.