Reviewed browser CRM screen pops open an approved HTTPS destination with explicitly selected fields after operator review. The embedded CRM agent widget remains planned. Internal application communication between Server and Client is private and automated.
The dedicated server-to-server integration API is disabled by default and limited to scoped minimal metadata reads and idempotent Chat/Social intake. User OAuth is a separate optional read-only interface: device-code and authorization-code flows require S256 PKCE, existing Server accounts, and explicit user consent; short-lived tokens are rechecked against current permissions.
One reviewed outbound webhook endpoint can deliver minimal interaction metadata after manual review. The receiver must verify the timestamp-bound HMAC and deduplicate event IDs; there are no automatic triggers, retries, or exactly-once delivery guarantee. Flow API calls use explicit host/path allowlists and per-flow credentials. Review the current configuration guide before enabling any integration.