Integrations

Integrations connect your organization to the outside services it relies on: the account that receives your sales, the account that hosts your videos, and the sites where you embed a course. This page describes how each one works under the hood, who can change it, and how credentials are kept safe.

For programmatic access — API keys and webhooks — see API keys and webhooks.

Where integrations live

Integrations are organization-scoped settings. The settings shell exposes them through a single Apps entry under the Integrations section, visible only to those with an organization owner or admin role. That entry opens the apps hub at /dashboard/settings/integrations: Available and Connected tabs, a search box, and category chips. Each app is opened from its own card — there is no sidebar item per brand.

Managing any of them requires an organization owner or admin role. Payments and video are described in depth below; the remaining apps are configured from their own cards in the hub.

The course embed is configured per piece of content, from the content's own editing screen, rather than from a central settings page.

Payments integration

Each organization has one active payment integration. It can use Stripe Connect or redirect buyers to a checkout the organization controls.

• Stripe Connect — Cursiva hosts the payment flow through Stripe, verifies the checkout, settles payouts and can issue automatic refunds.
• External checkout — Cursiva creates a purchaseRequest, signs the browser handoff, and redirects to the configured checkout URL. Revenue and access are created only after the external system posts a valid signed purchase.paid event.
• Restricted management — connecting, rotating the external secret, and disconnecting require an owner or admin role.
• One-time secret — an external integration receives an HMAC secret once. It is encrypted at rest, never returned by status endpoints, and rotating it invalidates the previous value immediately.

Once the account is connected, checkout, coupons, refunds, and payout timing all flow through the commercial side of your offerings. See Payments and payouts.

Video integration

This integration connects the organization to its own Cloudflare Stream account, to host videos uploaded by the producer themselves.

• Validated and encrypted credentials — when connecting, the account id and token are validated against Cloudflare before being saved; a typo fails on the spot, not silently at upload time. The token is stored encrypted and is only decrypted on the server.
• Direct upload — any member can generate a single-use upload URL; the browser sends the file directly to the organization's Cloudflare account. The bytes don't pass through Cursiva's servers, and the cost account is the organization's. The resulting uid is what the video block stores.
• Restricted management — connecting and disconnecting require an owner or admin role. Disconnecting doesn't interrupt already-published videos, which keep playing via their uid.
• Status without secrets — reading the status never exposes the token.

Beyond self-hosting, the editor's video block also accepts YouTube, Vimeo, and Loom embeds — no video integration required. See Blocks.

Course embed

Cursiva exposes a public embed client (embed.js) to publish a course on external sites, in the style of Cal.com. It's a lightweight, dependency-free loader with three modes:

The embed URL accepts a theme parameter (for example auto), read by the /embed page, so the embedded course can follow the host site's light or dark mode. Configure and copy the embed snippet from the content's own editing screen.

Integration best practices

• Record who set up each connection, which environment it uses, and how to revoke the credential.
• Treat every token and every secret as sensitive: shown once, stored as a hash or cipher, never in the frontend or screenshots.
• Test in the appropriate environment whenever you switch payment provider, video host, or embed target.