How to set up auth for Messenger app lifecycle flow

  • 13 November 2023
  • 1 reply

I am building an Messenger app for internal use only. How do I make sure app lifecycle flows (Initialize, Configure, Submit, and Sheet) can only be accessed by Intercom since those apis are public? 


Best answer by Eden 17 November 2023, 21:04

View original

1 reply

Userlevel 3

Hey @Mizuha 👋 Eden from the support engineer team here.


Each Canvas Kit request is signed by Intercom via an X-Body-Signature header. We do this so that you can check that each request is actually sent by Intercom by decoding the signature.


The value is computed by creating a signature using the body of the JSON request and your app's OAuth client_secret value, which you can find on the Basic Info page of your app. You can read more about this in our documentation here. 👍