Sign up to Context Link normally and pick the **RAG White-Label** plan. The last onboarding step walks you through getting the token, provisioning your first customer, and querying on a customer's behalf, and links straight to the docs and the fleet screen. You can revisit all of it here.

Then open **Settings** and scroll to **Partner provisioning token**.

<figure style="margin: 1rem 0;">
<img src="/docs/white-label/white-label-provisioning-token-settings.png" alt="The Partner provisioning token section of Context Link settings, showing a masked provisioning token, the default webhook URL field, a masked webhook signing secret, and API accounts and Rotate token buttons." style="max-width: 100%; border-radius: 8px;">
</figure>

**Generate token** does three things at once:

1. mints your **provisioning token** (copy it now, it is only readable here);
2. saves the **default webhook URL** typed alongside it;
3. generates your **webhook signing secret**, shown underneath.

Both secrets are masked in the field and revealed on focus. The token is server-generated (there is no value to hand-type), and rotating it invalidates the previous one **immediately**, so update your backend in the same deploy.

<figure style="margin: 1rem 0;">
<video src="/docs/white-label/white-label-provisioning-token.mp4" autoplay loop muted playsinline style="max-width: 100%; border-radius: 8px;"></video>
<figcaption style="margin-top: 0.5rem; font-size: 0.875rem; color: #6b7280;">Setting a default webhook URL and rotating the provisioning token. The token and signing secret are blurred here; in the app they are masked until you focus the field.</figcaption>
</figure>

The webhook URL must be a publicly routable http(s) URL; see [SSRF constraints on the webhook URL](/docs/white-label/webhooks). Setting a private or credential-bearing URL is rejected here rather than accepted and quietly dropped.