At work
Transket · Jul 2025 – Present
OAuth commerce integrations
Three OAuth-based commerce and CRM integrations with a full disconnect lifecycle, so tokens and side effects do not outlive the install.
The problem
Connecting a store or a CRM is the happy path everyone demos. The hard path is uninstall: tokens that still work, webhooks that still fire, and data that should no longer be reachable. A half-disconnected integration is worse than no integration.
What it is
External commerce and CRM tools needed a way into WhatsApp workflows without a standing hole in the product. I shipped three OAuth integrations and treated disconnect as a first-class path: revoke, purge, and stop side effects, not just hide a “connected” badge.
What I built
Each integration authenticates with OAuth and stays behind a boundary: the core product is not opened to arbitrary third-party calls. Commerce and CRM events can start WhatsApp workflows without copying the CRM’s permission model into every endpoint.
Disconnect is a lifecycle. Tokens are revoked, inbound webhooks are ignored or removed, and leftover side effects are stopped. An operator who uninstalls should not have to hunt for a daemon that is still sending.
How it fails
Expired or revoked tokens fail closed. A reconnect is a new grant, not a resurrection of the old one. Partial disconnect is treated as a bug, not as “good enough until they reconnect.”
Focus
- OAuth as the only standing credential
- Full disconnect lifecycle, not a UI toggle
- A controlled boundary between external tools and core workflows
What changed
- Three production integrations with a documented install and uninstall path.
- External automation can trigger workflows without a standing hole in the CRM.