Feature GuidesSettings
Settings
Configure your VoiceCenter account with API keys, webhooks, security controls, and platform preferences.
Who should read this:Administrators
The Settings section contains your account-level configuration. From API integrations to security controls, everything that governs how your VoiceCenter tenant behaves is managed here.
Settings Modules
| Module | Description |
|---|---|
| General Settings | API keys, webhooks, IP allowlist, and platform configuration |
What You Can Configure
Settings are split into functional areas:
| Area | Description | Status |
|---|---|---|
| General | Tenant profile and company information | Working |
| API Keys | Create and manage scoped API keys for integrations | Working |
| Webhooks | Configure HTTP endpoints to receive event notifications | Working |
| IP Allowlist | Restrict API and portal access to trusted IP addresses | Working |
| Email / SMTP | Outbound email configuration for notifications and alerts | Environment-driven |
Email/SMTP settings are configured through environment variables on the API server (SMTP_HOST, SMTP_PORT, SMTP_USER, SMTP_PASS, SMTP_FROM), not through the settings page. The settings page explains this to administrators.
Client vs. Provider Settings
Both the client portal and provider portal have settings pages, but they control different scopes:
| Setting | Client Portal | Provider Portal |
|---|---|---|
| API Keys | Tenant-scoped keys | Provider-scoped keys |
| Webhooks | Tenant events only | Platform-wide events |
| IP Allowlist | Restricts the tenant's access | Restricts provider access |
| Users | Tenant users (managed via Team) | Provider staff (managed via Admin) |
Security Best Practices
- Rotate API keys regularly. Keys can be rotated without downtime; the old key is revoked when the new one is created.
- Use IP allowlisting. If your integrations come from known IP addresses, restrict access to only those addresses.
- Test webhooks before relying on them. Use the built-in test button to verify your endpoint receives and processes events correctly.
- Limit key scopes. Create separate keys for different integrations, each with only the permissions it needs.