Building your app
External apps
When you create an External app you provide:
webhook_url: HTTPS URL that receives tenant events.webhook_events: subscription list.redirect_urls: OAuth callback URLs.
When a tenant installs your app, an installation token unique
to that (tenant, app) pair is issued. Use this token on every API
call. The token is long-lived until rotated or revoked. On rotation
you receive a webhook partner.installation.token_rotated; the old
token remains valid for 15 minutes for graceful deploy.