API setup and app review
Create a provider app, configure the connection, submit the required review and check the result.
Choose your task
Choose the service you want to connect. Site administrators create and configure provider apps. Workspace users connect their own permitted accounts after the administrator finishes setup.
Who does what
| You want to… | Follow this path |
|---|---|
| Connect your own account to an existing site | Ask the administrator whether the provider is ready → sign in to your workspace → open Channels → select the provider → authorize your own asset. |
| Set up a provider for your own installation | Create the provider app → copy its credentials into the application → register the application’s callback → test a connection. |
| Make the integration available to other customers | Complete the platform’s required production/review process → check granted access → retest with an eligible account. |
You do not create a separate developer app merely to use a workspace on an already configured site.
Before you start
| Prepare | What you need |
|---|---|
| Application address | Your actual reachable HTTPS site, such as https://app.your-company.example. All example domains in this guide must be replaced. |
| Public website and policy links | A developed public website and accurate Privacy Policy, Terms and any required deletion/contact instructions. Test these while signed out. |
| Owner account | The developer/business account authorized to own the integration. A workspace login is not that provider account. |
| Test asset | An authorized disposable Page, profile, channel, location or business number appropriate to the platform. |
| Application test user | A user with the plan, workspace role and enabled feature needed for the exact test. |
Know which value you are copying
| Value | Meaning / where to use it |
|---|---|
| App ID / Client ID / Client Key | Identifies the developer app. Copy it from the provider’s app credentials into the corresponding application field. |
| App Secret / Client Secret | The app’s private credential. Enter it privately in the matching administrator field. |
| Access token | Authorizes an account or asset. It is a different value from an App Secret. |
| Callback URL / Redirect URI | Where the provider returns the browser after OAuth. Copy the full URL from the application to the provider. |
| Webhook URL | Where the provider sends events. It is usually different from the OAuth callback. |
| Verify token | A shared webhook-verification value where the integration asks for one. It is not the provider access token. |
App setup and review: 15 steps
Choose the feature
Site owner
Write the exact action users need: connect a page, publish a post, read a report or receive a message.
Continue when One named feature and its provider.
Choose the app owner
Site owner
Use the business/developer account that will operate the service. Keep testing and production app details separate.
Continue when Owner, environment and contact address recorded.
Prepare the website
Site owner
Publish the real website, privacy policy, terms and any required data-deletion instructions. Check the links while signed out.
Continue when Working public links on your authorized domain.
Prepare a test installation
Administrator
Use a reachable HTTPS installation with the feature enabled and an appropriate test user/plan.
Continue when A reviewer can reach the real feature.
Create the provider app
Provider account owner
Follow the platform page below. Record the app/project ID and the exact product/API selected.
Continue when App exists under the intended owner.
Register URLs
Administrator
Copy the full Callback URL from the application into the provider’s redirect settings. Configure webhooks separately where required.
Continue when Exact redirect match; webhook verification succeeds if applicable.
Choose permissions
Administrator / developer
Compare actual configured scopes with the feature, source requests and provider access. Keep only justified, supported permissions.
Continue when One explanation and demonstration for each requested permission.
Save credentials
Administrator
Enter credentials in the matching application settings. Use the platform-specific guide; manual WhatsApp credentials belong to the workspace setup flow.
Continue when Settings save without exposing credentials in the guide or recording.
Connect a test asset
Workspace user
Connect the intended test account/page/number and select only its required assets.
Continue when The selected asset appears in the correct workspace.
Run the feature
Workspace user
Complete the action from beginning to end and check the provider result, not only the application success notice.
Continue when A reproducible successful test or a recorded issue.
Prepare reviewer access
Site owner
Prepare an application test account with the required plan and feature. Use only the provider’s supported test-asset and reviewer-access mechanisms.
Continue when Reviewer instructions work from a fresh browser session.
Record the demonstration
Site owner
Record login, provider consent, asset selection, feature use and result. Include each requested permission; hide keys/tokens.
Continue when A current video matching the submitted app and domain.
Complete the review form
App owner
Add use case, permission reasons, reviewer steps and video. Complete business/brand/data questions truthfully when the console requests them.
Continue when No unfinished placeholders or missing required fields.
Submit once and track the result
App owner
Review the complete application, select the platform’s submission action and record the request reference. Follow any clarification request against the exact rejected item.
Continue when The console records Submitted / In review, or a specific issue to fix.
Validate approved access
Administrator and workspace user
After approval, verify each granted scope/product, production access and quota. Reconnect when the grant changes, then repeat the real feature test before enabling it for customers.
Continue when Approval evidence and successful feature result; approval is not inferred from a saved connection.
Where to configure the application
Open the provider settings
Open Your application → /admin/integrations
Administrator
- Sign in to your application with an administrator account. Open API Integration. If the menu label differs, open
/admin/integrationson your own site. - Under Choose a provider, select the provider card. Wait for that provider’s fields to appear before entering values.
- Find its Callback URL. Copy the complete value from your running site. Keep this tab open while configuring the provider in a second tab.
- Use the platform guide to map the provider credentials to the fields. Do not copy an access token into a field named App Secret or Client Secret.
- Check Permissions against the features and access you actually need. Set Status to Enable for the configured test provider, then select Save configuration.
- Reopen the same provider. Check the app/client ID and displayed callback. A secret can be masked; do not clear or replace it merely because the interface hides it.
Expected result The intended provider reloads with the saved non-secret settings. This confirms a settings save, not provider approval.
If this does not happen If the card is missing, confirm the installed edition and enabled module. If access is denied, ask the administrator to check your role.
Check the connection
| Check | What to do | Expected result |
|---|---|---|
| Connect | Start from a signed-in test account, authorize the intended provider account and select the intended asset. | The selected account/page/number appears in your workspace. |
| Cancel consent | Cancel a new connection at the provider screen. | No new connected asset is reported as connected. |
| Use one feature | Run the single action covered by the requested permission on a test asset. | The result is visible in both the application and provider where applicable. |
| Access boundary | Use another test workspace that has not been granted the asset. | That workspace cannot operate on the first workspace’s asset. |
| Reconnect | Use the product’s reconnect flow after a test token has expired or been revoked. | The account returns to a usable state after authorization. |
| Disconnect | Disconnect only the disposable test connection and check the provider’s grant list. | Check both local disconnection and provider-side revocation; do not assume one automatically performs the other. |
Common setup problems
| Problem | What to check |
|---|---|
| Redirect URI mismatch | Copy the complete application Callback URL, including HTTPS, hostname, port if used, path and trailing slash. Use the same URL in the actual authorization request. |
| Scope is unavailable or permission is denied | Check the provider product, configured scope, granted permission and current access tier. Do not add unrelated scopes to try to bypass the error. |
| Callback works but no messages arrive | OAuth redirect and webhook callback are different endpoints. Verify the webhook and subscribe the intended asset/event. |
| Reviewer cannot reach the feature | Test the exact login URL, account, plan, feature/menu and asset prerequisites from a fresh session. |
| App saved but users still cannot connect | Saving a credential is not provider approval. Check production audience, account eligibility and grant status. |