I like the core idea, but I fail to see why this is a good solution. IIUC the workflow is: 1. Run a Lockbox server 2. Define the API request in automation too

I like the core idea, but I fail to see why this is a good solution. IIUC the workflow is: 1. Run a Lockbox server 2. Define the API request in automation tool as a webhook. 3. Proxy it via lockbox to add auth. All this really does it allow you to revoke auth at any time. As they can freely use the key. I see there are plans to restrict the requests allowed but doing that on the fully composed request it going to be extremely difficult to do reliably. If you are already hosting some API why not do something like this instead. 1. Run a Lockbox server. 2. Send a webhook from the automation tool that just contains the relevant variables. 3. Lockbox composes the variabless into a request. Basically if you want any sort of security and access control that is reliable you just want to send the parameters of the operation to Lockbox, then have the actual request generated on your server. Rather then doing the request generation in the automation tool then trying to validate that it was generated correctly.