Integrations overview
Understand how source providers, scoring and distribution systems connect to Clawdbase.
Integrations fall into three groups:
- Authority: GitHub, X and Telegram prove control of the originating identity or asset.
- Evidence and scoring: inVerus calculates or refreshes Trust and Confidence and returns relationship context.
- Distribution: Agent911 signals, wallets, referrals and embeds connect canonical Pages to external workflows.
Provider authentication is purpose-bound. A connect or add Page OAuth callback must not become a sign-in operation that replaces the active Clawdbase session.
inVerus
Scoring, timeout and failure behavior.
GitHub
Creator and repository authority.
X
OAuth 2.0 PKCE and immutable account IDs.
Telegram
Login, callback and control verification.
Integration boundaries
Authority providers establish control of an identity or asset. inVerus produces assessment evidence. Distribution systems carry canonical Page context into other workflows. Keeping these boundaries explicit prevents an OAuth login from becoming an unreviewed score, or a social signal from becoming ownership proof.
Integration lifecycle
Configure server secrets
Add credentials to the deployment secret store and register the exact production callback URLs. Public client identifiers may be exposed only where the provider requires them.
Start with a purpose
Every provider flow states whether it is primary sign-in, connection verification or Page registration. The signed state and return route preserve that purpose through callback.
Normalize immutable identity
Read provider IDs server-side, normalize mutable presentation fields and enforce global provider/account uniqueness.
Persist the right relation
Connections belong to a user. Canonical Pages represent public subjects. Ownership connects the two. Tokens remain private and separate.
Observe and recover
Track provider failures, expired intent, duplicate identity conflicts, scoring status and downstream event delivery without logging secrets.
Environment checklist
- Callback origins use one canonical host and HTTPS in production.
- OAuth state, nonce and PKCE values are short-lived and one-time.
- Provider tokens never enter public Page metadata or browser storage.
- Provider, inVerus and Stripe credentials remain server-only.
- Repeated provider or billing callbacks do not duplicate ownership or entitlements.
- Each integration has loading, cancellation, success, conflict and unavailable states.
Testing
Test each provider with a new identity, existing identity, identity owned by another user, cancellation, expired state and callback mismatch. Confirm the active Clawdbase session remains unchanged for connection and Page-registration flows.