Integrations: providers, credentials, OAuth, webhooks and API

Overview

Integrations connect ConversaLabs to the rest of your ecosystem. From the integrations area you enable ready-made connections and create your own extension points:

• Slack: mirror conversations in a Slack channel and reply from there.
• Dialogflow: connect a Dialogflow bot for automated replies.
• Notion and Linear: bring conversation context into your productivity and engineering tools.
• Shopify: pull order/customer data from your store into support.
• Video and voice calls (Cloudflare RealtimeKit): the agent starts a call with the customer inside the conversation itself. This integration used to be called Dyte and now runs on Cloudflare RealtimeKit — the credentials changed.
• Credential-based providers: connect translation, video, CRM, AI, voice and search with your own keys or service accounts.
• Webhooks: receive platform events at your own endpoint, in real time.
• Dashboard Apps: embed your own web app in the conversation or account sidebar, with native audience, order and compatibility controls when enabled.
• API: automate and integrate via access tokens.

Prerequisites

• The Administrator role or a native role with Manage integrations permission to configure account connections.
• Credentials/accounts for the tools you'll connect (for example, a Slack workspace, a Dialogflow project, a Shopify store).
• For webhooks/API: an accessible endpoint and/or an access token generated in the account.
• For video/voice calls: a Cloudflare account with a RealtimeKit app created and an API token with Realtime Admin permission. Connecting and disconnecting this integration takes the same access as any other: Administrator or a native role with Manage integrations.
• To verify Slack webhook signatures: your Slack app's Signing Secret, applied at the installation level (not per account) — see below.

Step by step

1. Open the Integrations area in Settings.
2. Pick the integration. On credential forms, the shortcuts above the fields include the provider's name:
   • Get provider credentials opens the official key or service-account page;
   • Open provider console opens the API or console that must be enabled, when applicable;
   • View provider setup documentation opens the corresponding official guide.
3. Fill in the fields with data from the same project/account and finish creating the connection.
4. For webhooks, register your endpoint URL and select the events of interest; validate receipt in your system.
5. For the API, generate an access token (profile/agent) and use it in authenticated calls.
6. Test the integration with a real conversation before going to production.

Set up video calls with Cloudflare RealtimeKit

1. In Cloudflare, create (or locate) the RealtimeKit app and note its app ID.

2. Note your Cloudflare account ID as well, and create an API token with Realtime Admin permission for that account.

3. In ConversaLabs, open Integrations and pick the video integration. Fill in the three fields:

   • Cloudflare Account ID
   • RealtimeKit App ID
   • Cloudflare API Token

   On this integration, the shortcuts above the fields still point at the previous provider's pages (dev.dyte.io and docs.dyte.io). Ignore them: all three values come from the Cloudflare dashboard.

4. Save. The platform validates the credentials right away: it checks that the token is active and that the RealtimeKit App ID exists in that Cloudflare account. If something doesn't match, the connection isn't created and the error message points at the exact field to review.

5. Open a conversation and start the call. The platform posts an invitation message in the conversation; participants use Click here to join and end with Leave the room.

If you were already using the old integration (Dyte): it stays registered but can no longer open calls. Trying to start a meeting returns "Cloudflare RealtimeKit credentials are required. Delete the existing Dyte integration and create it again with Cloudflare RealtimeKit credentials." — and that is exactly the path: delete the old connection and create a new one with the three fields above. This integration's screen offers only Connect and Disconnect, so there is no form for swapping the old fields (organization ID and API key) in place.

Turn on Slack webhook signature verification

1. In your Slack app's dashboard, copy the Signing Secret.
2. Apply the value at the installation level, in one of these ways:
   • in Super Admin, under the Slack configuration group, in the Slack Signing Secret field; or
   • in the server's SLACK_SIGNING_SECRET environment variable.
3. Send an event from Slack again and confirm the conversation still arrives normally.

While the secret is not configured, the platform does not reject the webhook: it only writes a warning to the log and processes the event — existing installations keep working unchanged. Verification only kicks in once you fill in the secret, and that is what protects the endpoint against forged calls.

Settings & options

• Authorization-based connections (Slack, Shopify, etc.): follow the external tool's login.
• Key/project-based connections (Dialogflow, Google Translate, Cloudflare RealtimeKit, LeadSquared, and AI, voice, or search providers): require the provider's credentials.
• Webhooks per event: you choose which events to receive.
• API tokens: treat them like passwords; revoke them if leaked or unused.

Cloudflare RealtimeKit fields

All three fields are required, and the form accepts no field beyond them. The "Visible after saving" column applies to administrators; the API token is never returned by the platform to anyone. Because the integration only has Connect and Disconnect, changing any of the three values means disconnecting and connecting again.

Where the Slack Signing Secret lives

The secret belongs to the installation, not to an account. The platform looks for the value in this order:

1. the Slack Signing Secret installation setting (Super Admin);
2. the SLACK_SIGNING_SECRET environment variable.

If the panel field exists but is blank, the environment variable is still used — so an installation that already set the secret through the environment stays protected after the upgrade.

Verification uses the signature Slack sends in the X-Slack-Signature and X-Slack-Request-Timestamp headers, with HMAC-SHA256 over the raw request body. A webhook is rejected with 401 when one of those headers is missing, when the request timestamp is more than 5 minutes away from the server clock, or when the signature doesn't match.

Use cases

• Notify a Slack channel when a new conversation arrives.
• Automatic triage with a Dialogflow bot before reaching an agent.
• Create a Linear issue from a customer-reported bug.
• Show Shopify order data right on the conversation screen.
• Sync events with your CRM or ERP via webhooks.
• Settle a complex case on the spot by opening a video call with the customer, without pulling them out of the channel they were already in.
• Harden the Slack webhook endpoint against forged calls by turning on the signing secret.

Tips, limits & best practices

• Start with one integration, validate the flow, then add others.
• For webhooks, implement idempotency and respond fast (process in the background).
• Store tokens in your system's environment variables — never in public source code.
• Review integrations and tokens periodically; remove what's no longer used.
• Give the Cloudflare token the smallest scope that still includes Realtime Admin: that is the permission both validation and the calls require.
• Confirm the three RealtimeKit fields belong to the same Cloudflare account. An App ID that is valid in another account is rejected with the app-not-found message.
• The Slack signature's 5-minute window depends on the server clock: keep time sync (NTP) healthy, or legitimate webhooks start being rejected.
• When you rotate the Signing Secret in Slack, update the value on the platform in the same window — between the rotation and the update, events are rejected.

Troubleshooting

• The integration won't connect: check credentials/permissions and try re-authorizing.
• The webhook isn't arriving: verify the URL is public, returns success (2xx) and is subscribed to the right events.
• API 401 error: the token is wrong, expired or revoked — generate a new one.
• I don't see the integration I want: it may depend on the plan or a specific enablement.
• Shopify needs attention: follow the dedicated guide before reconnecting the store.
• "Cloudflare API token is invalid or inactive": the token failed Cloudflare's own check. Create a new token with Realtime Admin permissions.
• "Cloudflare Account ID is invalid, or the API token does not have Realtime Admin access to this account": the token is valid but doesn't reach that account. Review the account ID and the token's scope.
• "RealtimeKit App ID was not found in this Cloudflare account": the app doesn't exist in that account. Check that you copied the App ID from the right environment.
• "Could not verify Cloudflare RealtimeKit credentials right now": Cloudflare didn't answer in time or returned a temporary error. Try saving again.
• The video call won't open and asks for RealtimeKit credentials: the connection is still the old Dyte one. Delete it and create the integration again with the three Cloudflare RealtimeKit fields.
• Slack events stopped with 401: the configured secret doesn't match the Slack app's, or the server clock is outside the 5-minute window. Compare the Signing Secret and check the server time.

See also

• Dashboard Apps: native surfaces, audience and security
• Custom Scripts: inject JS/CSS
• Custom roles and governance (RBAC)
• Audit logs
• Administration overview