Integrations and webhooks
Provider connections
Section titled “Provider connections”Use Configure → Integrations to inspect supported providers. Select the actual provider organization and map the intended app explicitly. A connected credential alone does not prove the app mapping or catalog is correct.
App Store Connect connections belong to the workspace and can represent multiple Apple organizations. Map a discovered Apple app to the intended Live One iOS app. Test and Live One rows do not need duplicate Apple credentials for this workspace connection.
Stripe and customer-authentication configuration must match the app and environment. For APNs, check bundle identity and the app’s notification registration flow. Keep private keys and secrets in credential fields, not remote config or client code.
Three webhook concepts
Section titled “Three webhook concepts”| Kind | Direction | Purpose |
|---|---|---|
| Provider webhook | Apple or Stripe → One | Update verified billing and access facts |
| Outbound destination | One → your backend | Deliver selected events to your service |
| Rule webhook action | A rule → a configured callback | Run an advanced conditional action |
Create normal backend callbacks under Webhooks. A rule webhook is not a substitute for the destination/delivery system.
Receive events reliably
Section titled “Receive events reliably”Use the signing mechanism and event contract supplied by the destination configuration. Verify signatures before trusting a delivery. Store the delivery/event identity so retries cannot apply the same business change twice. Respond promptly and move long-running work to your own queue.
Inspect delivery attempts before retrying. A lost response can mean your receiver already processed the event. Do not blindly repeat a payment-related side effect.
Verify
Section titled “Verify”Test a valid event, a duplicate, an invalid signature, a temporary receiver failure, and recovery. Check both One’s attempt record and your receiver’s durable result. Use the correct provider environment and avoid recording credentials in logs.