Integrations
The organization has four connection capabilities. They are listed once under Settings → Integrations, without an app marketplace, installation states, or duplicate brand pages.
| Capability | Provider | Purpose |
|---|---|---|
| Payments | Stripe or signed external checkout | Receive and verify course sales |
| Video | Cloudflare Stream | Upload and stream private learning video |
| Meta Cloud API | Notify the team about sales and enrollments | |
| Analytics or Tag Manager | Measure eligible public school pages |
Only an owner or administrator can connect, replace credentials, change settings, or disconnect. Status responses contain safe identities and settings, never tokens or secrets. Each organization has at most one row per capability.
Payments
Stripe Connect provides hosted checkout, provider verification, payouts, and automatic refund support. A signed external checkout receives a one-time encrypted HMAC secret and must confirm payment through a valid signed event. A browser return URL never creates a purchase.
To enable sales, complete the school's legal seller profile and Express-account onboarding. Charges run directly in that account; Cursare schedules daily payouts with an 8-day delay and only marks the connection ready when charges, payouts, and that schedule are confirmed. “Pending balance” is still settling; “available balance” can fund refunds or go to the bank. Refunds debit the school, so keep a reserve and handle failures under Refunds. See Payments & payouts.
Disconnecting Payments stops new paid checkout. The stable connection id remains the callback identity while the connection exists.
Video
Cursare validates the Cloudflare account and token before saving them. The token is encrypted. Upload bytes travel directly from the browser to Cloudflare through a one-time upload URL; they never pass through Cursare.
Replacing credentials affects new operations. Disconnecting stops new uploads but does not delete or rewrite videos already stored in course documents.
Credential replacement is separate from operational settings. Administrators can replace the phone identity and access token without re-entering recipients or templates, and can edit recipients and the approved template without resubmitting credentials. A test action sends a real provider request and surfaces a focused failure.
Google Analytics and Tag Manager
Google uses one persistent OAuth identity and one exclusive delivery method:
- Direct GA4 loads the selected web stream only after analytics consent.
- Google Tag Manager loads the selected public web container only after marketing consent.
Setup discovers accounts, properties, web streams, and web containers by name. Raw ids cannot be pasted to bypass provider access checks. Choices are saved so interrupted setup can resume. Disable keeps the identity and selections; Disconnect removes the encrypted refresh token, selections, managed drafts, and public tracking.
The storefront emits the canonical analytics catalog for discovery, promotion selection, checkout, and learning interactions. Purchases, refunds, enrollments, progress, and completions come from server-verified facts. Exactly one browser delivery method is active, so the same outcome is not sent through GA4 and GTM simultaneously. Scripts never load in the dashboard or on the canonical platform host, and eligible public delivery still respects consent and minor-safety rules.
Legacy cursare_* event aliases are no longer emitted. User-owned GTM triggers must listen to the canonical names shown in the integration screen; Cursare never rewrites those user-owned entities.
Managed Tag Manager setup
The base Google connection is read-only. Configure events for me requests Analytics discovery plus Tag Manager edit and publish scopes separately. Cursare creates or updates only Cursare-named tags, triggers, and variables inside an isolated workspace.
The administrator sees the exact pending entities and GA4 destination before publishing. Preparing or refreshing the preview never changes the live container version. Publication requires an explicit confirmation with the saved preview fingerprint; a provider conflict or failed publication preserves the draft for retry.
API status
GET /api/v1/integrations is the only aggregate status operation. Provider-specific operations live under /api/v1/integrations/*. OAuth assistant connections use /api/v1/mcp/connections instead.