| name | intercom-deploy-integration |
| description | Deploy Intercom integrations to Vercel, Fly.io, and Cloud Run with proper secrets.
Use when deploying Intercom-powered applications to production, configuring
platform-specific secrets, or setting up signed webhook endpoints and health checks.
Trigger with phrases like "deploy intercom", "intercom Vercel",
"intercom production deploy", "intercom Cloud Run", "intercom Fly.io".
|
| allowed-tools | Read, Write, Edit, Bash(vercel:*), Bash(fly:*), Bash(gcloud:*) |
| version | 1.6.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","support","messaging","intercom"] |
| compatibility | Designed for Claude Code |
Intercom Deploy Integration
Overview
Deploy Intercom-powered applications to Vercel, Fly.io, or Google Cloud Run with proper
secret management, signed webhook endpoints, and health checks. The workflow is the same
across platforms — provision two secrets, deploy, wire a /health probe, then register
the webhook URL — and each platform's copy-ready code lives in
references/implementation.md.
Prerequisites
- Intercom production access token
- Platform CLI installed (
vercel, flyctl, or gcloud)
- Application with Intercom integration ready for deployment
Authentication
Two secrets drive every deployment. INTERCOM_ACCESS_TOKEN authenticates API calls
(passed to the SDK as new IntercomClient({ token })); INTERCOM_WEBHOOK_SECRET is the
Developer Hub signing secret used to verify inbound webhook payloads (HMAC-SHA1 over the
raw body, compared against the X-Hub-Signature header). Store both in the platform's
secret store — never hardcode them: vercel env add, fly secrets set, or Cloud Run
Secret Manager. A mismatched webhook secret returns 401 Invalid signature; an invalid
token surfaces as a degraded health check rather than a hard failure.
Instructions
Pick the platform that matches your stack. Each step below shows the essential skeleton;
open references/implementation.md for the complete webhook
handler, vercel.json, fly.toml, Cloud Run deploy script, and shared health-check code.
Step 1: Choose a platform and provision secrets
- Vercel (serverless):
vercel env add INTERCOM_ACCESS_TOKEN production then
vercel env add INTERCOM_WEBHOOK_SECRET production.
- Fly.io (long-running):
fly secrets set INTERCOM_ACCESS_TOKEN=... INTERCOM_WEBHOOK_SECRET=....
- Cloud Run (container): store both in Secret Manager and mount with
--set-secrets.
Step 2: Write the signed webhook handler
Read the raw request body (disable body parsing), recompute the HMAC-SHA1 signature, and
compare with crypto.timingSafeEqual. Return within 5 seconds — queue slower work:
expected = + crypto
.(, process..!)
.(rawBody)
.();
(!crypto.(.(sig), .(expected))) res.().();
