API tokens, webhooks and calendar feedsNew

In API and feeds:

• API tokens act as you, limited to the permissions and boards you choose, and expire when you say. A token is shown once. The REST API lives at /api/v1 and is described in /api/v1/openapi.json. Send done: true to complete a task (or false to reopen it); unknown fields are refused rather than ignored. Each token can make 600 requests a minute.
• Webhooks send JSON to your https address when tasks are created, changed, moved, completed or deleted, when someone comments, and more. Each delivery carries a Viremail-Signature header: t= the time and v1= an HMAC-SHA256 of “time.body” made with your secret. Failed deliveries are retried for up to a day, you can send any delivery again, and 50 failures in a row turn a webhook off. A webhook belongs to the admin who set it up. It stops as soon as they leave the board or stop being an admin; another admin can turn it back on after checking where it sends, and it becomes theirs with a new secret. Pointing someone else’s webhook at a new address, or making it a new secret, also makes it yours, tells the person who had it, and is written to the board’s activity and the audit log.
• Calendar feeds are secret addresses for My tasks or a board that any calendar app can subscribe to. They show titles only unless you include descriptions. Regenerate an address if it leaks.

In Calendar, Board tasks in the calendar list shows tasks assigned to you on their due dates.