YourCRM Connector

1. Email arrives → support@yourcompany.com
2. Disqua creates ticket from email
3. Disqua POSTs to your endpoint (async, non-blocking):
       POST https://your-api.com/crm/lookup
       X-API-Key: your-secret
       { "email": "jan.novak@company.cz", "ticket_id": "uuid", ... }
4. Your server queries its CRM/database
5. Your server responds with customer data
6. Disqua shows the result in the ticket sidebar:
       ✓ Jan Novák  [Pro zákazník]  Plan: Business  MRR: €149
       [Zobrazit v CRM →]

POST /crm/lookup HTTP/1.1
Content-Type: application/json
User-Agent: Disqua-CRM-Connector/1.0
X-API-Key: your-secret-here     ← your configured secret header

{
  "email":        "jan.novak@company.cz",   // sender's email address
  "ticket_id":    "b8a1bf5d-8ce7-46ac-...",  // Disqua ticket UUID
  "workspace_id": "f8e7e88d-2108-11f1-...",  // Disqua workspace UUID
  "source":       "disqua-helpdesk"            // always this value
}

{
  "found":       true,
  "customer_id": "12345",             // used in link_template substitution
  "name":        "Jan Novák",          // displayed in ticket sidebar
  "badge":       "Business zákazník",  // badge label (max 30 chars)
  "badge_color": "green",             // green | blue | yellow | red | gray
  "fields": {                              // max 5 fields displayed
    "Plan":        "Business",
    "MRR":         "€149",
    "Zákazník od": "2023-04-15",
    "Tickets":    "47",
    "NPS":         "9"
  }
}

{
  "found": false
}

// Install: npm install express
const express = require('express');
const app = express();
app.use(express.json());

app.post('/crm/lookup', async (req, res) => {
  // Verify the secret
  if (req.headers['x-api-key'] !== process.env.DISQUA_SECRET) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  const { email } = req.body;

  // Query your database
  const customer = await db.query(
    'SELECT * FROM customers WHERE email = ?', [email]
  );

  if (!customer) {
    return res.json({ found: false });
  }

  res.json({
    found: true,
    customer_id: customer.id,
    name: customer.full_name,
    badge: customer.plan + ' Customer',
    badge_color: customer.plan === 'business' ? 'green' : 'blue',
    fields: {
      'Plan':       customer.plan,
      'MRR':        '€' + customer.mrr,
      'Member since': customer.created_at.toISOString().slice(0, 10),
      'Tickets':    String(customer.ticket_count),
    },
  });
});

app.listen(3000);

<?php
// Verify the secret header
if ($_SERVER['HTTP_X_API_KEY'] !== getenv('DISQUA_SECRET')) {
    http_response_code(401);
    die(json_encode(['error' => 'Unauthorized']));
}

$body = json_decode(file_get_contents('php://input'), true);
$email = $body['email'] ?? '';

// Query your database
$stmt = $pdo->prepare('SELECT * FROM customers WHERE email = ?');
$stmt->execute([$email]);
$customer = $stmt->fetch();

header('Content-Type: application/json');

if (!$customer) {
    echo json_encode(['found' => false]);
    exit;
}

echo json_encode([
    'found'       => true,
    'customer_id' => $customer['id'],
    'name'        => $customer['full_name'],
    'badge'       => ucfirst($customer['plan']) . ' Customer',
    'badge_color' => 'green',
    'fields'      => [
        'Plan'    => $customer['plan'],
        'MRR'     => '€' . $customer['mrr'],
        'Tickets' => (string)$customer['ticket_count'],
    ],
]);

# pip install flask
from flask import Flask, request, jsonify
import os

app = Flask(__name__)

@app.route('/crm/lookup', methods=['POST'])
def crm_lookup():
    # Verify the secret
    if request.headers.get('X-API-Key') != os.environ['DISQUA_SECRET']:
        return jsonify({'error': 'Unauthorized'}), 401

    email = request.json.get('email')

    # Query your database
    customer = db.session.query(Customer).filter_by(email=email).first()

    if not customer:
        return jsonify({'found': False})

    return jsonify({
        'found':       True,
        'customer_id': str(customer.id),
        'name':        customer.full_name,
        'badge':       customer.plan.title() + ' Customer',
        'badge_color': 'green',
        'fields': {
            'Plan':    customer.plan,
            'MRR':     f'€{customer.mrr}',
            'Tickets': str(customer.ticket_count),
        }
    })

// Node.js — verify secret header
const SECRET = process.env.DISQUA_CRM_SECRET;

app.post('/crm/lookup', (req, res) => {
  const incoming = req.headers['x-api-key'];

  // Use timing-safe comparison to prevent timing attacks
  if (!incoming || !crypto.timingSafeEqual(
    Buffer.from(incoming),
    Buffer.from(SECRET)
  )) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  // proceed...
});

curl -s -X POST https://your-api.com/crm/lookup \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your-secret" \
  -d '{
    "email": "test@example.com",
    "ticket_id": "test-ticket-id",
    "workspace_id": "test-workspace-id",
    "source": "disqua-helpdesk"
  }'