Skip to main content

APIs · Webhooks · Integrations

Making software you don't own work for you.

Connecting the systems your business already runs on. Reading from them, writing back to them, and holding the whole thing together when tokens expire and the other end goes quiet. We run two live integrations of our own against a platform we do not control.

Four reasons people call

Nobody rings up wanting an API integration. They ring up because one of these is happening.

Two systems that should talk, and do not

Orders in one place, stock in another, and somebody re-keying between them every morning before they can start their real job. The integration is usually smaller than the workaround it replaces, and it stops being anyone's daily chore.

You want to build on someone else's platform

Your customers already use something. A fitness platform, an accounting package, a booking system. You want to add to it rather than ask them to move house. That means connecting to an API you do not control, on their terms.

The data exists, just not in a useful shape

Readings, transactions or activity records turning up one at a time, with no way to see the pattern across the lot of them. Turning that stream into something a person can act on is the actual work.

It works until it does not

Tokens expire. Rate limits get hit. The other end goes down mid-request, and a duplicate event turns up twice for good measure. Integrations mostly fail at the edges, and the edges are the bit we build for.

Turning private swims into public data

Ours, running live, and a fair demonstration of what an integration has to survive.

Worked example

SeaSwims.Club

Swimmers already record their swims on a fitness platform. The site connects to that platform, reads each swim as it gets uploaded, and adds what the swimmer's watch could not measure. Sea temperature, wind, swell and tide at that beach at that moment.

On its own that is just a nicer swim record. Pooled across everybody, it becomes a crowd-sourced sea temperature history for the coastline. A genuine environmental dataset, put together out of swims that were happening anyway.

Visit SeaSwims.Club
Sign in once, no password handed over
Members connect their account through the platform's own login. We never see a password. They can disconnect at any time from either end, and that gets honoured straight away rather than eventually.
The platform pushes, we do not pull
When a member uploads a swim, the platform tells the site within seconds. That is the whole ingestion path. No scheduled job scanning for changes, no wasted calls, nothing more than a minute stale.
One record, several sources
A swim arrives as a track and a duration. It leaves with water temperature, air temperature, wind, swell and tide for that spot at that moment, pulled from an open marine data service.
Single readings become a public record
Pooled across members and locations, those one-off swims turn into a sea temperature history for a beach. Crowd-sourced environmental data that no single swimmer could have produced alone.

Where integrations actually break

The demo is the easy part. These six are what separate something that runs for years from something that quietly stopped last March.

Tokens that expire
Access is time-limited by design. Refreshing quietly in the background, and coping with a member who has revoked access, is the difference between an integration that lasts and one that stopped in March and nobody noticed.
Rate limits
Every API has a budget. Designing so the common path spends nothing (caching, storing what you already fetched, batching) is what keeps a service inside its allowance as it grows.
Events arriving twice
Networks retry. A webhook processed twice must not produce two of anything. Every handler gets written so a repeat is harmless.
The other end falling over
Third-party services have outages. Work gets retried with sensible backoff, failures get logged with enough detail to replay them, and nothing is lost because a request happened at an unlucky moment.
Data you do not control changing
Fields get added, removed, or start turning up null. We validate what comes in rather than trusting it, so a change at their end shows up as a logged warning instead of a broken page.
Privacy and consent
Member data pulled from another platform carries obligations. Access is gated on the server, members choose what is public, and disconnecting genuinely removes the connection.

What the live integrations do

Live

since 2023

Two production integrations running against the Strava API, continuously. Reading activities as they get uploaded, and writing back to them.

Webhooks,

not polling

The platform tells us when something happens instead of us asking every few minutes. Fewer calls, no rate-limit ceiling to worry about, and data that is current rather than up to a quarter of an hour old.

1,000/day

budget, respected

The API allows a fixed number of calls a day. Enrichment is designed so most of the work happens without spending one, which is why the ceiling has never been the thing holding us up.

Two APIs

joined per record

Each swim gets matched against a keyless marine and weather service, so a raw activity turns into water temperature, wind, swell and tide at that spot at that moment.

What we do with integrations

Connecting to other people's systems, and building the ones other people connect to.

  • REST API integration: reading, writing and syncing
  • OAuth2 connections, token refresh and handling revocation properly
  • Webhook endpoints: validation, idempotency, retries and replay
  • Third-party data enrichment, several sources per record
  • Stripe: subscriptions, checkout, billing portal and webhooks
  • Payment and entitlement logic gated on the server, never in the browser
  • Scheduled jobs and background processing
  • Rate-limit budgeting and caching strategy
  • Building and documenting APIs for other people to consume
  • SMS, email and messaging gateway integration
  • Data pipelines and reporting off integrated sources
  • Monitoring, alerting and an audit trail for every external call

Common questions

What is an API, in business terms?

A defined way for one system to ask another for something, or tell it something, with no person in between. If two pieces of software in your business are kept in step by somebody copying between them, that is usually a job an API can do instead.

Can you connect to a platform we do not own?

Usually, if they publish an API, and most large platforms do. What we can do is bounded by what they allow, so the first step is always reading their terms and their limits. We would rather tell you early that something is not permitted than find out late and bill you for the discovery.

What happens when their API changes?

It will. We validate everything arriving rather than assuming it is well formed, so a change usually surfaces as a logged warning instead of a broken page. Integrations need the occasional bit of maintenance, and we would rather set that expectation up front than pretend otherwise.

Is our data safe in an integration like this?

Credentials stay on the server and never reach the browser. Access gets checked on the server for every request rather than assumed from what the interface is showing. Where members connect their own accounts, disconnecting genuinely removes the connection at both ends.

Webhooks or polling. Does it matter?

More than it sounds. Polling means asking over and over whether anything has changed, which burns your API budget and leaves the data stale between checks. A webhook means being told the moment it happens. Where a platform offers webhooks, we use them.

How long does an integration take?

A straightforward one-way sync can be a couple of weeks. Something with member authentication, webhooks, billing and enrichment is more like two to three months. The variable is rarely the coding. It is how well the other end is documented.

Tell us what is being re-keyed

The best integrations usually start life as somebody's manual routine. Tell us which two systems are out of step and who is keeping them in line by hand. That is normally enough for us to say what it would take to stop.