Skip to main content
A send gives LithoBlocks the data needed to compile a template and gives Slack the resulting message. Interactive messages also carry configuration and context used for later clicks and modal openings. A configured webhook sends its rendered payload to your receiver.

​
Keep credentials separate from content

Store API keys in server-side secrets. Destination credentials belong in headers; API destination responses mask them. Do not put secrets in URL query strings, sample data, button values, chart labels, or template placeholders. Use separate credentials for preview and production. Give each integration only its required scopes. See API key rotation.

​
Minimize retained and shared data

Send only fields needed by the template and its actions. Do not assume a field is private because it is not visible in the message: original context can travel with interactivity metadata and diagnostic records. Use synthetic examples in sample data and AI prompts. Before publishing a community template or shared component, review its content, example values, destination references, and URLs. Interaction APIs return sanitized outcome fields. Modal submission values can still contain personal data, so grant history access appropriately. Retention and deletion requirements should be confirmed with support; this guide does not promise a fixed retention period.

​
Authenticate receivers

Ordinary button and submission requests use the destination’s configured headers. Verify those credentials and validate the payload at your receiver. Give each business operation a stable identifier and deduplicate it before applying a state change. The destination-test API has its own HMAC signature. That signature is not automatically attached to ordinary webhook deliveries. See Destination tests.

​
Report a concern

Revoke exposed credentials and contact support with the environment, affected resource IDs, and timestamps. Share redacted evidence; never send the secret itself.