Start by identifying who or what is making the request. Lead intake, user actions, organization services, webhooks, and AI tools use different trust boundaries.
Choose the integration path
A source key authorizes the external lead-ingestion routes only. It cannot read organization data or replace a user token or organization API key.
Build the integration
- Select the identity. Decide whether the caller is a source, user, organization service, or webhook recipient.
- Use the matching credential. Never broaden access to avoid implementing the correct authentication flow.
- Choose HTTP or an SDK. Use direct HTTP for simple integrations or a generated SDK for typed models and route builders.
- Handle failure explicitly. Validate status codes, respect rate limits, and retry only when the operation is safe.
- Test the real path. Exercise production authentication, payload construction, error handling, and downstream effects with controlled data.
Production baseline
- Use HTTPS for every request.
- Store credentials in protected runtime configuration or a secret manager.
- Keep credentials and sensitive payloads out of logs and URLs.
- Grant only the access the integration needs.
- Rotate exposed or unused credentials.
- Validate webhook signatures before processing side effects.
- Make retryable operations idempotent where duplicates matter.
- Treat lead, contact, and conversation data as sensitive.
SDKs
Use the API Reference for endpoint contracts and the OpenAPI specification for code generation or schema tooling. 
