Integration

Settings

Everything this installation needs to talk to TripleEnable. It is stored in this CRM’s own database, so a freshly published deployment is configured from here and nowhere else.

This installation is configured. The checks at the bottom say whether it works.

This installation receives webhooks at

https://bank.demo-te.com/api/webhooks/te-api

Paste it in the TripleEnable console, under Credentials → Webhook. Registering it hands back the signing secret, and that is the only time it is shown in full — it goes in the field below.

Where these values come from

The rule: The database is the source of truth. What is saved here is what runs. There is no second place to look.
Environment variables: Not read. They can only seed an installation whose settings row does not exist yet — this one already has one.
Still required in the environment: DATABASE_URL, and nothing else. It is where all of this is stored, so it cannot be stored inside it.

This console has no login. Anyone who can reach this address can open this screen. Secrets are write-only — they are never shown again, only their fingerprint — but until employee sign-in exists, do not leave an installation holding real secrets on a public address without something in front of it.

Who this installation is

The organization in Logto that this CRM issues and verifies on behalf of. Its administrator creates it in the TripleEnable console.

Logto organization IDChanging it does not migrate anything: the existing customers, verifications and events stay attached to the old one.Organization nameFor this console only. The legal name is whatever te-api states.

DomainNo scheme. This is the installation’s identity: the did:web it publishes and the webhook address above are both built from it.Sector referenceThe field the holder recognises the relationship by. It is the only one the new-customer form offers, so the wrong one puts another trade’s box in front of an agent.

Official phone numbersComma separated. They travel inside the signed credential, so a wrong one is worse than none.

Machine-to-machine application

What authenticates this installation against te-api. It is the only application it declares, and it authenticates a server — never a person.

Client IDClient secret1f00341f04476b38…etySShown in full only once, when the console creates it. Its fingerprint is computed the same way there and here, so the two can be compared by eye.Clear the stored secret when saving

Webhook signing secret

What separates an event from te-api from a POST written by anybody. Without it every delivery is refused — there is no accept-without-checking mode.

Signing secret2b7df37691a39a63…BaJkPaste it exactly as the console handed it over, prefix included. It is an opaque string, not encoded key material: stripping the prefix or decoding the tail produces a different MAC and every delivery is refused.Clear the stored secret when saving

Brand

Two colours and a monogram. The accent goes on white; the surface is the sidebar. Status colours are not brand and are not set here.

AccentSurfaceMonogram

Platform addresses

The same for every installation of the product, so they come pre-filled and are rarely touched. They are here so a test Logto is possible without an environment variable.

Logto endpointte-api base URL

B2B resource indicatorThe aud te-api demands. It must match te-api’s own value character by character — one trailing slash and the token is for another resource.Scopes requestedSpace separated. Logto silently trims whatever the organization role does not grant, with no error, so what was actually obtained is the scope on the token — the connection check below shows it.

Check the connection to TripleEnable

Asks Logto for a token with the saved credentials and calls GET /v1/b2b/organization with it. It checks four things at once: the secret, the resource, the scopes, and whether this organization is enrolled. It tests what is saved, not what is typed above.

Ask TripleEnable to call this CRM

The only direction that cannot be checked from in here, so it has to be asked for. te-api queues a webhook.test, signs it with this organization’s secret and delivers it to the address it has registered. It is also the only delivery that goes out while a destination is on probation, and a 2xx is what promotes it.