## Overview

**Integrations** connect ConversaLabs to the rest of your ecosystem. From the integrations area you
enable ready-made connections and create your own extension points:

- **Slack**: mirror conversations in a Slack channel and reply from there.
- **Dialogflow**: connect a Dialogflow bot for automated replies.
- **Notion** and **Linear**: bring conversation context into your productivity and engineering tools.
- **Shopify**: pull order/customer data from your store into support.
- **Video and voice calls (Cloudflare RealtimeKit)**: the agent starts a call with the customer
  inside the conversation itself. This integration used to be called **Dyte** and now runs on
  Cloudflare RealtimeKit — the credentials changed.
- **Credential-based providers**: connect translation, video, CRM, AI, voice and search with your
  own keys or service accounts.
- **Webhooks**: receive platform events at your own endpoint, in real time.
- **Dashboard Apps**: embed your own web app in the conversation or account sidebar, with native
  audience, order and compatibility controls when enabled.
- **API**: automate and integrate via access tokens.

## Prerequisites

- The **Administrator** role or a native role with **Manage integrations** permission to configure account connections.
- Credentials/accounts for the tools you'll connect (for example, a Slack workspace, a Dialogflow
  project, a Shopify store).
- For webhooks/API: an accessible endpoint and/or an access token generated in the account.
- For **video/voice calls**: a Cloudflare account with a **RealtimeKit** app created and an API
  token with **Realtime Admin** permission. Connecting and disconnecting this integration takes the
  same access as any other: **Administrator** or a native role with **Manage integrations**.
- To verify **Slack webhook** signatures: your Slack app's *Signing Secret*, applied at the
  installation level (not per account) — see below.

## Step by step

1. Open the **Integrations** area in Settings.
2. Pick the integration. On credential forms, the shortcuts above the fields include the provider's
   name:
   - **Get _provider_ credentials** opens the official key or service-account page;
   - **Open _provider_ console** opens the API or console that must be enabled, when applicable;
   - **View _provider_ setup documentation** opens the corresponding official guide.
3. Fill in the fields with data from the same project/account and finish creating the connection.
4. For **webhooks**, register your endpoint URL and select the events of interest; validate receipt
   in your system.
5. For the **API**, generate an access token (profile/agent) and use it in authenticated calls.
6. Test the integration with a real conversation before going to production.

### Set up video calls with Cloudflare RealtimeKit

1. In Cloudflare, create (or locate) the **RealtimeKit** app and note its **app ID**.
2. Note your Cloudflare **account ID** as well, and create an **API token** with **Realtime Admin**
   permission for that account.
3. In ConversaLabs, open **Integrations** and pick the video integration. Fill in the three fields:
   - **Cloudflare Account ID**
   - **RealtimeKit App ID**
   - **Cloudflare API Token**

   On this integration, the shortcuts above the fields still point at the previous provider's pages
   (`dev.dyte.io` and `docs.dyte.io`). Ignore them: all three values come from the Cloudflare
   dashboard.
4. Save. The platform validates the credentials right away: it checks that the token is active and
   that the **RealtimeKit App ID** exists in that Cloudflare account. If something doesn't match,
   the connection isn't created and the error message points at the exact field to review.
5. Open a conversation and start the call. The platform posts an invitation message in the
   conversation; participants use **Click here to join** and end with **Leave the room**.

**If you were already using the old integration (Dyte):** it stays registered but can no longer open
calls. Trying to start a meeting returns *"Cloudflare RealtimeKit credentials are required. Delete
the existing Dyte integration and create it again with Cloudflare RealtimeKit credentials."* — and
that is exactly the path: **delete the old connection and create a new one** with the three fields
above. This integration's screen offers only **Connect** and **Disconnect**, so there is no form for
swapping the old fields (*organization ID* and *API key*) in place.

### Turn on Slack webhook signature verification

1. In your Slack app's dashboard, copy the **Signing Secret**.
2. Apply the value at the installation level, in one of these ways:
   - in **Super Admin**, under the Slack configuration group, in the **Slack Signing Secret** field; or
   - in the server's `SLACK_SIGNING_SECRET` environment variable.
3. Send an event from Slack again and confirm the conversation still arrives normally.

While the secret is **not** configured, the platform does **not** reject the webhook: it only writes
a warning to the log and processes the event — existing installations keep working unchanged.
Verification only kicks in once you fill in the secret, and that is what protects the endpoint
against forged calls.

## Settings & options

- **Authorization-based connections** (Slack, Shopify, etc.): follow the external tool's login.
- **Key/project-based connections** (Dialogflow, Google Translate, Cloudflare RealtimeKit,
  LeadSquared, and AI, voice, or search providers): require the provider's credentials.
- **Webhooks per event**: you choose which events to receive.
- **API tokens**: treat them like passwords; revoke them if leaked or unused.

### Cloudflare RealtimeKit fields

| Form field | Required | What it is | Visible after saving |
|---|---|---|---|
| Cloudflare Account ID | Yes | Your Cloudflare account ID | Yes |
| RealtimeKit App ID | Yes | The RealtimeKit app ID inside that account | Yes |
| Cloudflare API Token | Yes | API token with **Realtime Admin** permission | No |

All three fields are required, and the form accepts no field beyond them. The "Visible after
saving" column applies to administrators; the API token is never returned by the platform to anyone.
Because the integration only has **Connect** and **Disconnect**, changing any of the three values
means disconnecting and connecting again.

### Where the Slack Signing Secret lives

The secret belongs to the **installation**, not to an account. The platform looks for the value in
this order:

1. the **Slack Signing Secret** installation setting (Super Admin);
2. the `SLACK_SIGNING_SECRET` environment variable.

If the panel field exists but is **blank**, the environment variable is still used — so an
installation that already set the secret through the environment stays protected after the upgrade.

Verification uses the signature Slack sends in the `X-Slack-Signature` and
`X-Slack-Request-Timestamp` headers, with HMAC-SHA256 over the raw request body. A webhook is
rejected with **401** when one of those headers is missing, when the request timestamp is more than
**5 minutes** away from the server clock, or when the signature doesn't match.

## Use cases

- Notify a Slack channel when a new conversation arrives.
- Automatic triage with a Dialogflow bot before reaching an agent.
- Create a Linear issue from a customer-reported bug.
- Show Shopify order data right on the conversation screen.
- Sync events with your CRM or ERP via webhooks.
- Settle a complex case on the spot by opening a video call with the customer, without pulling them
  out of the channel they were already in.
- Harden the Slack webhook endpoint against forged calls by turning on the signing secret.

## Tips, limits & best practices

- Start with **one** integration, validate the flow, then add others.
- For webhooks, implement **idempotency** and respond fast (process in the background).
- Store tokens in your system's environment variables — never in public source code.
- Review integrations and tokens periodically; remove what's no longer used.
- Give the Cloudflare token the **smallest scope** that still includes **Realtime Admin**: that is
  the permission both validation and the calls require.
- Confirm the three RealtimeKit fields belong to the **same** Cloudflare account. An App ID that is
  valid in another account is rejected with the app-not-found message.
- The Slack signature's 5-minute window depends on the server clock: keep time sync (NTP) healthy,
  or legitimate webhooks start being rejected.
- When you rotate the Signing Secret in Slack, update the value on the platform in the same window —
  between the rotation and the update, events are rejected.

## Troubleshooting

- **The integration won't connect**: check credentials/permissions and try re-authorizing.
- **The webhook isn't arriving**: verify the URL is public, returns success (2xx) and is subscribed
  to the right events.
- **API 401 error**: the token is wrong, expired or revoked — generate a new one.
- **I don't see the integration I want**: it may depend on the plan or a specific enablement.
- **Shopify needs attention**: follow the [dedicated guide](/hc/ajuda/articles/administration-shopify-en) before reconnecting the store.
- **"Cloudflare API token is invalid or inactive"**: the token failed Cloudflare's own check. Create
  a new token with **Realtime Admin** permissions.
- **"Cloudflare Account ID is invalid, or the API token does not have Realtime Admin access to this
  account"**: the token is valid but doesn't reach that account. Review the account ID and the
  token's scope.
- **"RealtimeKit App ID was not found in this Cloudflare account"**: the app doesn't exist in that
  account. Check that you copied the App ID from the right environment.
- **"Could not verify Cloudflare RealtimeKit credentials right now"**: Cloudflare didn't answer in
  time or returned a temporary error. Try saving again.
- **The video call won't open and asks for RealtimeKit credentials**: the connection is still the old
  Dyte one. Delete it and create the integration again with the three Cloudflare RealtimeKit fields.
- **Slack events stopped with 401**: the configured secret doesn't match the Slack app's, or the
  server clock is outside the 5-minute window. Compare the Signing Secret and check the server time.

## See also

- [Dashboard Apps: native surfaces, audience and security](/hc/ajuda/articles/administration-dashboard-apps-native-surfaces-en)
- [Custom Scripts: inject JS/CSS](/hc/ajuda/articles/administration-custom-scripts-en)
- [Custom roles and governance (RBAC)](/hc/ajuda/articles/administration-custom-roles-governanca-rbac-en)
- [Audit logs](/hc/ajuda/articles/administration-auditoria-en)
- [Administration overview](/hc/ajuda/articles/administration-overview-en)