Protect a SmartApp callback without exposing reusable credentials to customers or agents.
SmartApp configuration can attach static request headers. A common pattern is an authorization header checked by your callback.
Authorization: Bearer smartapp_SERVICE_TOKENGenerate a dedicated high-entropy credential for each environment or SmartApp instance. Store only a hash where possible, grant the narrowest access required, rotate it periodically, and revoke it when the SmartApp is removed.
Authentication proves the request has the configured credential; it does not decide which customer record may be returned. Validate every dynamic identifier and enforce tenant boundaries before querying data.
No signed-callback contract
The public SmartApp documentation does not describe request signing, timestamps, source IPs, or a ThriveDesk-issued identity token. Do not assume an undocumented header is trustworthy.