Oauth / Webhooks

Need help APIs
1

Hi Bubblers !

I have an app and trying to integrate it with Pipedrive.

The use case is :

  1. my users will connect their Pipedrive account from my App. I allow users to connect their pipedrive account with an OAuth2 flow as request in Pipedrive doc. Everything works well.

  2. I create a webhook in their pipedrive account by calling a POST endpoint from my bubble app (server-side) to pipedrive, Authenticating with Bearer access token. Works well.

  3. Then my app will receive webhooks from their Pipedrive account to deal with their data. And here is the tricky part as I’d like to secure the endpoint by authorizing only authenticated calls received.

But :
Pipedrive webhooks onlysupport basic HTTP auth.
So if I want to secure the endpoint where I receive webhooks from pipedrive, I have to provide pipedrive http_auth_user / http_auth_password when creating the webhook, as mention in their doc.
But you can’t do this from bubble as you don’t have access to users password (which is good). Is there anything I am missing ? Could someone help with this ? How could I do this ?

I also tried a workaround by creating a specific password for each of my client, store it (with privacy rules, no one can see it), send it in a encrypted way when I create the pipedrive webhook. This way the endpoint would be without authentication, but I would be able to catch if the authorization headers match one of my client account specific password, and don’t allow any workflow from an attacker.
I can see that it works, and pipedrive sending back in the webhook headers the Authorization(containing “Basic user:password”), but it is base64 encoded, and I can’t figure out how to decode it server side on bubble ? So can’t do the matching with my database ? Any idea ?

Any help would be much appreciated :slight_smile:

2

Did you ever find a solution? I’m dealing with a similar issue.

3

Your users will need to authenticate with Ouath.

This processo will lead them to their PipeDrive account, where they will need to grant access to your app to access their account.

This will redirect them to a page in your app, where you will receive their token and a refresh token. You will need to store their refresh token, that will be used in every call in order to regenerate their token (that expires in some minutes if I remember correctly).

4

Hi
I ended up generating a random password server side on Bubble for each account that connects to Pipedrive and save it to the account.

The app provide it when creating the webhook through the Pipedrive API.

Everytime the Bubble app receives a webhook, I decode the Authorization Basic and find the corresponding connected account, or trigger an error processing workflow if it doesn’t.

I finally decode the Authorisation Basic from pipedrive with a plugin “base 64 encode/decode”.
Don’t usually like to use plugins but didn’t find an other solution.

It has some drawbacks but it works well like this.
I believe pipedrive has made some changes in their API, and I am sure other smartest solution exist :slight_smile:

5

Yes
What you describe is the Oauth flow and how to handle further api call and refresh their access token.
The point here is more how to securely authenticate created/incoming webhooks received from pipedrive after the Oauth process has been done