third-party-integrations
Third-party integrations
Your product acts in systems it doesn't own, with credentials users lent it, against APIs that rate-limit, change, go down and revoke tokens. Most integration bugs are not in the API call: they are a connection stored under the wrong user, a token that quietly expired, a sync that marked live records deleted, a webhook from a stranger, or an agent that wrote to the wrong account.
Apply only the routes and checks for the selected job. Read a linked skill's named file from its installed folder when available, or from the linked source. Report an unavailable required reference instead of inventing it. [skill-authoring, DISTRIBUTION.md#composing-skills]
| The job | Read |
|---|---|
| Connections: who owns one, the connect flow, OAuth apps and scopes, storing the connection, several accounts per user, checking which account connected, refresh, revocation and reconnect, credential custody | CONNECTIONS.md |
| Using them: calling the API, rate limits, retries and ambiguous writes, syncing data incrementally, detecting deletes, webhooks in and out, a unified model across providers, per-customer settings, testing | CALLS-AND-SYNC.md |
| An agent acting through connected accounts: scoped tool sets, approvals by effect, connecting mid-chat, errors that say what to do, raw-API escape hatches, standing automations | AGENT-ACCESS.md |
| Verifying a webhook signature, encrypting stored tokens, SSRF | the secure-coding skill |
| Delivering your own events reliably (outbox, retries) | the messaging skill |
| Kapso WhatsApp onboarding, messages, webhooks, native forms, workflows, Functions and Calling | kapso |
Build or buy
An integration platform (managed OAuth, token storage and refresh, a proxy, sync runtimes, tool catalogs for agents) saves months when you need many providers. Building it yourself fits one or two providers you know well. Either way the rules below are yours: the platform stores the tokens, but who owns a connection, what an agent may do with it and what a sync may delete are decisions in your code.