Intercom access tokens are server-only. The Messenger app ID is public, but without identity verification anyone can claim another user identity. Sign user IDs on your server with the identity verification secret and call the REST API only from trusted code.
Loads the Messenger widget.
Reads and writes contacts, conversations, and tickets.
Signs user_hash or JWT values for Messenger.
Generate the user hash or JWT on your server for each logged-in user.
Strip internal notes, admin assignments, and tags before returning data.
Users can pass another email or user ID and read their conversation history.
The access token would expose every customer conversation.
Store INTERCOM_TOKEN in the vault and expose pipelines that return a slim list of the signed-in user conversations without internal notes.
It stops visitors from impersonating other users in the Messenger by requiring a server-signed identity.
You should not store Intercom credentials in Bubble.io client code. Removes Intercom PAT from Bubble connector configuration and network logs. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Intercom credentials in React client code. Intercom contacts and events via edge proxy with server-side Bearer token. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To combine intercom users with clerk user metadata, use one RealComposer pipeline with parallel steps. Clerk user profile and Intercom contact record stitched for in-app chat. Your React / Flutter / Mobile app makes one request instead of several sequential upstream calls.
To solve combine intercom conversations and zendesk tickets, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.
To combine intercom with posthog user events, use one RealComposer pipeline with parallel steps. Intercom conversation list plus PostHog person properties in one payload. Your React app makes one request instead of several sequential upstream calls.
Appsmith apps hit CORS and credential limits when calling Intercom and Zendesk. Multi-step Intercom and Zendesk proxy for Appsmith dashboards. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.
HMAC authentication uses a hash-based message authentication code, computed from a message and a shared secret key, to prove that a request came from a holder of the secret and was not modified. The receiver recomputes the HMAC and compares it to the value sent.
Field MaskingField masking is the technique of applying a list of allowed or excluded field paths to an API response so only selected properties are returned. Masks can be allowlists that keep named fields or denylists that remove sensitive or unnecessary ones.
PII RedactionPII redaction is removing or masking personally identifiable information, such as names, email addresses, phone numbers, and payment details, from data before it is exposed, logged, or shared. In APIs, redaction ensures clients and logs receive only the personal data they truly need.