Integrations, Webhooks & Developer Security
A practical integration guide covering API credentials, trusted domains, callbacks, webhook verification, retries and safe server-side architecture.
Keep secrets server-side
Never put a secret API key, webhook signing secret or privileged access token in browser JavaScript. Use environment variables on a server or trusted backend.
Webhooks
- 1Register the HTTPS callback URL with the provider.
- 2Verify the provider’s callback challenge where required.
- 3Verify webhook signatures before processing events.
- 4Return the required success response quickly.
- 5Process events idempotently so duplicate deliveries do not create duplicate records.
Retries and event processing
Webhooks are commonly delivered on an at-least-once basis. Store an event ID or other stable identifier and make handlers safe to retry. Use queues or background processing when an event requires expensive work.
Facebook / Meta integrations
Meta integrations commonly use an app, access tokens and permission scopes. Meta’s official API collections document Page access tokens and Page tasks for managed Pages, as well as messaging and publishing workflows. Keep access tokens server-side and request only the permissions the product actually needs.
Instagram integrations
Meta’s current Instagram API documentation covers Professional accounts, content publishing, comments, mentions, insights and messaging. The API distinguishes Facebook Login and Instagram Login setups, and the supported scopes and account requirements differ. Do not assume a consumer Instagram account has the same API access as a Professional account.
WhatsApp Business Platform
WhatsApp Cloud API is designed for business messaging and uses a WhatsApp Business Account, business phone number, access tokens and webhook subscriptions. Inbound messages and status events should be handled through the configured webhook endpoint, with credentials kept on the server.
TikTok integrations
TikTok’s current developer documentation covers OAuth, trusted domains, URL ownership verification, Content Posting API, creator information, publishing status and webhooks. Direct posting requires the relevant authorised scope, and TikTok documents moderation/processing states before public availability.
Frequently asked questions
Can I call a privileged API directly from the browser?＋
Do not expose privileged secrets in browser code. Put the provider request behind a trusted server route.
Why should webhook handlers be idempotent?＋
Providers can retry deliveries or deliver an event more than once. Idempotent processing prevents duplicate orders, messages, notifications or other side effects.
Do Meta and TikTok integrations require the same permissions?＋
No. Each provider defines its own scopes, consent, review, redirect, domain and webhook requirements. Request only the capabilities the integration actually needs.
Social-platform integrations
Third-party platforms such as TikTok and Meta use scopes, redirect URIs, trusted domains, webhooks and explicit user authorisation. Integration documentation should describe what data or publishing capability is requested and why.