Connect LexCore to your other tools: API tokens and webhooks

Your firm already uses other tools: a website form, a shared drive, a team chat, a task list. API tokens and webhooks let those tools and LexCore pass work to each other, so nobody has to copy things across by hand.

What you gain

• Less copying and pasting. A request typed into your website, or a contract saved to a folder, reaches LexCore without anyone re-entering it.
• Faster responses. Your team hears the moment a review is done, a request comes in, a document is fully signed, or a finding needs a lawyer.
• Your tools, your way. LexCore does not need a ready-made connector for every product. Anything that can call a web address can join in.
• Control stays with you. You choose exactly what each token may do, you can switch it off at once, and every change is written to the audit log.

Before you start

• Plan. API tokens and webhooks come with the Chambers plan and above.
• Who can set them up. Workspace owners, heads of legal, heads of chambers, managing partners and senior partners. Everyone else can see the list but not change it.
• Two-factor sign-in. Creating an API token needs a verified second factor. Set it up under Settings, Account & Security, then sign in again.
• Where. Settings, then Integrations. Both panels are at the top.

Make an API token

1. Open Settings, then Integrations, and click New token.
2. Give it a name that says what it is for, for example "Website form to new requests". You will thank yourself later.
3. Tick only what the tool needs. A tool that only files finished reviews needs Read review results, nothing else.
4. Click Create token and copy it straight away. We show it only once. If you lose it, revoke it and make a new one.
5. Paste it into your tool. It goes in the request header as Authorization: Bearer followed by the token.

Make a webhook

1. In your tool (n8n, Zapier, Make, Power Automate), create a step that receives a web request. It gives you a web address. Copy it.
2. In LexCore, open Settings, then Integrations, and click New webhook.
3. Paste the address, tick the moments you care about, and click Create webhook.
4. Copy the secret shown. We show it only once. Your tool uses it to check that each message really came from LexCore.
5. Click Send test. LexCore tells you whether the test arrived, and if not, why.

If something goes wrong

• A message does not arrive. LexCore tries each message up to three times: at once, after 1 minute, and after 5 minutes.
• Three failures in a row. LexCore pauses the webhook and tells the workspace owners, so a broken address does not fail quietly for weeks. Fix the address, then click Turn back on.
• The address is refused when you save it. On LexCore Cloud a webhook must go to a public https:// address. Addresses inside a private network are refused, because a shared service must never be pointed at its own internals. On a dedicated sovereign deployment the rule is reversed: your own in-house tools are allowed, and outside addresses can be blocked by your administrator.
• A token stops working. Check it was not revoked, that the person who made it still has an active account, and that it has the permission the tool is using.

For whoever builds the connection

The API base address is your LexCore address followed by /api/v1/cases (on LexCore Cloud, https://app.lexcore.ng/api/v1/cases). A token can reach exactly these routes:

curl https://app.lexcore.ng/api/v1/cases/matters \
  -H "Authorization: Bearer lxk_your_token_here"

Every webhook is a POST with a JSON body, sent with four headers: X-LexCore-Event, X-LexCore-Delivery, X-LexCore-Timestamp (Unix seconds) and X-LexCore-Signature. The signature is the hex HMAC-SHA256 of timestamp.body, keyed with your webhook secret. LexCore does not follow redirects, so give the final address.

{
  "id": "the delivery id",
  "event": "review.completed",
  "createdAt": "2026-09-18T09:15:00.000Z",
  "attempt": 1,
  "data": { "jobId": "…", "documentId": "…", "matterId": "…", "reviewLogId": "…" }
}

Check the signature before you trust a message. In Node.js:

const crypto = require("crypto");

// timestamp = X-LexCore-Timestamp header, signature = X-LexCore-Signature header,
// rawBody = the request body exactly as received (before JSON parsing).
function isFromLexCore(secret, timestamp, rawBody, signature) {
  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!(age <= 300)) return false; // older than 5 minutes: refuse
  const expected = crypto
    .createHmac("sha256", secret)
    .update(timestamp + "." + rawBody)
    .digest("hex");
  return expected.length === signature.length &&
    crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}