Integrations
Integrations (Configuration → Integrations) shows every outside service Threadline uses on one page, so you can see at a glance what is set up and what is not.
The problem it solves
Threadline depends on several outside companies: an AI provider to write answers, a storage place for files, Google for sign-in, Meta for WhatsApp. Their settings used to live on separate pages. Now you see the whole picture and jump to the right form.
How it works
Each service is a card in a group. A card says Configured or Not configured, whether it is switched on, and has a button that opens its form. Some cards also have Test and a Setup guide.
| Group | What it is for | Where you set it up |
|---|---|---|
| AI | OpenAI, Anthropic, Gemini and OpenRouter. These models write replies. Your clients bring no AI keys. They all use yours. | AI Provider Setup |
| Sign-in | Lets people sign in with their Google account. | Google Auth Settings |
| Storage | Where uploaded documents and images are kept: this server's disk, or an S3-compatible service. | Storage Settings |
| Lead finder | Google Places, used by the Lead finder to search for businesses. | The Google Places card, below |
| Website chat | Cloudflare Turnstile, an optional check website chat visitors pass before their first message (also used on your Contact Us form). | The Cloudflare Turnstile card, below |
| Social posting | Your TikTok and LinkedIn developer apps, so clients connect those accounts with one click and post to them. | The TikTok and LinkedIn cards, below |
| Video meetings | Your Zoom app, so clients connect their own Zoom account and online bookings get a Zoom meeting. Google Meet needs no extra app. | The Zoom card, below |
| Ads & analytics | Your own Meta Pixel (with the Conversions API) and Google Analytics, to measure the ads that bring you new clients. | The Ads & analytics card, below |
| Meta | One shared Meta app so clients can connect WhatsApp, Instagram and Messenger in one click. | Meta App & One-click Connect |
Test buttons
- Storage → Test writes a small file, reads it back and deletes it. It tells you right away if a bucket name or key is wrong, instead of a customer finding out when an upload fails.
- Google Places → Test makes a small search with your key.
- Cloudflare Turnstile → Test asks Cloudflare whether it recognises your secret key.
- Zoom → Test asks Zoom whether it recognises your app's client ID and secret.
- TikTok → Test and LinkedIn → Test ask the network whether it recognises your app's client key (or ID) and secret. Connecting a real account is the final check.
- Meta → Test checks your token and lists any permission that is missing.
- Ads & analytics → Test asks Meta whether your Conversions API token may send events for your Pixel. It sends no event.
Google Places (Lead finder)
The Lead finder searches Google for businesses. By default each client uses their own Google key. You may share your key with them.
- In Google Cloud Console, create or choose a project and switch on billing.
- Enable Places API (New) under APIs and services.
- Create an API key under Credentials and restrict it to Places API (New).
- Paste the key in API key and press Test.
- To share it, switch on Let workspaces search with this key.
Google bills your key for every search a client runs on it. Each plan's monthly Lead credits limit how many leads that can be. Searches that return phone numbers and websites use Google's higher-priced fields, so set a budget alert in Google Cloud. A client with their own key never uses yours.
Cloudflare Turnstile (website chat)
The website chat's embed code is public, so anyone can copy it. Clients can already limit their chat to their own websites, and new visitors are limited per network and per hour. Cloudflare Turnstile adds one more, optional step: a short check, usually invisible, that a visitor passes before their first message. It keeps scripted spam out of your clients' inboxes and AI budgets. A visitor already chatting is never asked again. It is off until you switch it on, and your clients set nothing. When it is on, your own Contact Us page asks visitors for the same check before their message is sent.
- In the Cloudflare dashboard, open Turnstile and add a widget. A free account is enough, and your domain does not have to use Cloudflare.
- Add one hostname: your platform's own domain (the page shows it). The check runs on your domain in a small frame inside the chat, so it works on every client's website without adding theirs.
- Choose Managed (recommended) or Invisible.
- In Threadline, open Integrations → Cloudflare Turnstile, paste the site key and the secret key, press Test the key, switch on Check new website chat visitors and save.
The check page must be allowed in a frame. It is /widget/challenge and sends its own Content-Security-Policy: frame-ancestors *. The Docker setup already allows it. If your server or hosting panel adds an X-Frame-Options header to every page, leave that one page out, or the check stays blank on your clients' websites.
If Cloudflare cannot be reached, visitors are let through, so the chat never goes down because of the check.
TikTok (social posting)
Lets your clients connect TikTok accounts with Connect with TikTok and post videos to them from the Social module. You register one app with TikTok for the whole platform; clients set nothing. Videos are uploaded to TikTok in parts, so they work on any hosting and any storage. TikTok then processes each video for a few minutes before it is live.
- At TikTok for Developers, create an app and add the Login Kit and Content Posting API products. In Content Posting API, switch on Direct Post.
- In Login Kit (web), add the redirect URI shown on the TikTok card. It is a fixed address on your domain ending in
/social/accounts/connect/tiktok/callback. - Ask for the scopes
user.info.basicandvideo.publish. - In Threadline, open Integrations → TikTok, paste the client key and client secret, save, and press Test the keys.
- Submit the app for TikTok's review. The post screen already follows TikTok's rules for apps that post: the account's name, privacy chosen by hand with no default, comments, duets and stitches off until the client switches them on, the commercial content disclosure, and TikTok's consent text.
Until TikTok approves your app, it can only post as "Only me" from private TikTok accounts, for a few accounts a day. Clients see TikTok's message when they try anything else. Review usually takes a few days.
TikTok fetches videos from this site is optional. TikTok's guidelines prefer that an app with the files already on its server lets TikTok download them. Switch it on only after verifying, in your TikTok app's URL properties, the domain the videos are served from (your domain, or your storage's public domain). Without that, every post fails.
LinkedIn (social posting)
Lets your clients connect their LinkedIn profile, and their company pages if your app allows it, with Connect with LinkedIn, then post text, up to 20 pictures, or a video. Clients set nothing.
- In the LinkedIn Developer Portal, create an app linked to your company page.
- Under Products, add Share on LinkedIn and Sign In with LinkedIn using OpenID Connect. Both are approved at once.
- Under Auth, add the redirect URL shown on the LinkedIn card (it ends in
/social/accounts/connect/linkedin/callback). - In Threadline, open Integrations → LinkedIn, paste the client ID and client secret, save, and press Test the keys.
- For company pages, request the Community Management API under Products. When LinkedIn approves it, switch on My app has the Community Management API. Each page a client administers is then connected as its own account.
Do not switch on the Community Management setting before LinkedIn approves it. LinkedIn refuses any sign-in that asks for a permission the app does not have, so no client could connect LinkedIn at all.
LinkedIn sign-ins last about 60 days; clients are asked to reconnect after that. LinkedIn also retires each version of its API after a year. Threadline picks a version LinkedIn still supports by itself, so posting keeps working even if you skip some updates. Leave API version blank unless LinkedIn support tells you to use a particular one.
Zoom (online bookings)
Clients can hold a booking service on Zoom: each booking then gets its own Zoom meeting, made in the client's own Zoom account. You register one Zoom app; each client presses Connect Zoom under Bookings, Setup.
- On the Zoom App Marketplace, choose Develop → Build App → General App and make it user-managed.
- Add the OAuth redirect URL shown on the Zoom card (it ends in
/bookings/setup/zoom/callback), also to the allow list. - Under Scopes, add the scopes the card lists (create, update and delete meetings, and read the user).
- In Threadline, open Integrations → Zoom, paste the client ID and client secret, save, and press Test the keys.
- Until the app is published, only users of your own Zoom account can connect it. Publish it on the Marketplace (or share it as Zoom describes) before clients use it.
Google Meet needs nothing here: it uses your Google sign-in app and the client's Google Calendar connection.
Ads & analytics (Meta Pixel and Google Analytics)
When you run ads for your platform on Facebook, Instagram or Google, these show which ads bring visitors, sign-ups and paying clients, so Meta and Google can find more people like them. The tags load on your public website, the sign-in and sign-up pages, plan choice and checkout only. They never load inside a client's workspace, and never for you, your staff, or while you are logged in as a client.
| Moment | Meta event | Google event | Sent from |
|---|---|---|---|
| A public page is opened | PageView | page_view | Browser |
| A new workspace signs up (email or Google) | CompleteRegistration | sign_up | Browser and server |
| A Contact Us message is sent | Lead | generate_lead | Browser and server |
| A client is sent to the payment page | InitiateCheckout | begin_checkout | Server |
| A subscription's first payment succeeds, with its amount | Purchase | purchase | Server |
The server copy is what makes this reliable: ad blockers cannot hide it, and a payment is confirmed by your payment gateway after the client has left the page, so it can only be reported from the server. Meta receives the browser and server copies of an event with the same event ID and counts it once. Renewals are not reported again: they are not new clients. Payments you record by hand (Manual) are never reported.
Meta
- In Meta Events Manager, connect a Web data source (a pixel), or open the one your ads already use, and copy its ID.
- Open its Settings → Conversions API → Generate access token.
- In Threadline, open Integrations → Ads & analytics, paste the Pixel ID and the token, switch on Load the Meta Pixel and Send events from the server, save, and press Test the token.
- To check events arrive, copy the code from Events Manager → Test events into Test event code. Server events then show there and do not count in your ads. Clear the code when you are done.
- In your ad set, choose Purchase or Complete registration as the conversion event.
Google Analytics
- In Google Analytics, create a GA4 property with a Web data stream for your domain, and copy its Measurement ID (it starts with
G-). - In the stream's Enhanced measurement settings, open Page views and turn off Page changes based on browser history events. Threadline reports page changes itself; with this on, pages would be counted twice.
- To see checkouts and payments, create a key under the same stream's Measurement Protocol API secrets.
- In Threadline, paste the Measurement ID and the API secret, switch on Load Google Analytics and save. Then mark
purchaseandsign_upas key events in Google Analytics.
Visitor consent. Ask visitors before tracking is on by default. Visitors see a small cookie banner, and nothing is loaded or sent for a visitor until they press Accept; a client who declined is not reported when they pay later either. The EU and the UK require this. Switch it off only if none of your visitors are there. Either way, mention Meta and Google in your privacy policy.
This is for your own ads. Your clients have their own, separate setting under Settings → Conversions, which tells Meta when a person who came from a client's Click-to-WhatsApp ad bought or became a lead.
Keys are protected
Every key is saved encrypted and shown masked after saving. To keep the saved value, leave its field empty when you save.
Common questions
A card says Not configured. Click it and fill in the form.
Do my clients need their own AI key? No. They all share yours. The plan's Max AI cost / month keeps usage under control. See AI Usage.