> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forepost.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Front, Plain, Zendesk

> Connect a non-Intercom helpdesk via OAuth so Forepost can read today's metrics directly.

Intercom is Forepost's longest-running integration, but it isn't the only one. **Front**, **Plain**, and **Zendesk** are supported via the same OAuth + encrypted-token shape.

<Warning>
  OAuth scaffolds are in place for all three. **Metric adapters for these providers are still stubs** — they're not yet pulling volume / CSAT / FRT. CSV import remains the live path until those adapters land. See [Import data](/help/import-data).
</Warning>

## What's the same

For every provider, Forepost:

<Steps>
  <Step title="Generates a signed OAuth state">
    `GET /integrations/<provider>/start` returns an authorize URL.
  </Step>

  <Step title="Redirects to the provider">
    You approve Forepost in the helpdesk's UI.
  </Step>

  <Step title="Exchanges the code for a token">
    `POST /integrations/<provider>/complete` swaps the code for an access (and where supported, refresh) token.
  </Step>

  <Step title="Stores the token AES-GCM encrypted">
    In the same `helpdesk_connections` table Intercom uses. Refreshes on the same hourly cron as Intercom once a metric adapter ships.
  </Step>
</Steps>

## What's different per provider

<AccordionGroup>
  <Accordion title="Front" icon="square-f">
    Uses `app.frontapp.com/oauth/authorize` with `scope=shared:*`. No subdomain needed.
  </Accordion>

  <Accordion title="Plain" icon="cube">
    Uses `app.plain.com/oauth/authorize`. No subdomain needed.
  </Accordion>

  <Accordion title="Zendesk" icon="headset">
    Requires your workspace subdomain. If your Zendesk is `acme.zendesk.com`, the subdomain is `acme`. Pass it as `?subdomain=acme` on the start endpoint. Scope is `read`.
  </Accordion>
</AccordionGroup>

## Required environment

To enable each provider, set the matching env vars on the worker:

```bash theme={null}
FRONT_CLIENT_ID, FRONT_CLIENT_SECRET
PLAIN_CLIENT_ID, PLAIN_CLIENT_SECRET
ZENDESK_CLIENT_ID, ZENDESK_CLIENT_SECRET
```

Without these, the start endpoint returns a 500 with a clear message (*"missing FRONT\_CLIENT\_ID"*).

## API

```bash theme={null}
GET  /integrations/front/start            # owner/admin: returns auth URL
POST /integrations/front/complete         # owner/admin: body { code, state }

GET  /integrations/plain/start
POST /integrations/plain/complete

GET  /integrations/zendesk/start?subdomain=acme
POST /integrations/zendesk/complete       # body { code, state, subdomain }
```

The `connectedAt`, `lastRefreshedAt`, and `lastRefreshStatus` fields on `/integrations/connections` work identically across providers.

## What's not in this release

The OAuth + token-storage path is wired. The **metric adapters** — the per-provider functions that turn API responses into volume/CSAT/FRT — are stubbed:

<CardGroup cols={2}>
  <Card title="Front" icon="square-f">
    Not yet mapped. Front's Analytics API is the right source.
  </Card>

  <Card title="Plain" icon="cube">
    Not yet mapped. Plain's GraphQL needs custom queries.
  </Card>

  <Card title="Zendesk" icon="headset">
    Not yet mapped. Zendesk's Search and Views APIs.
  </Card>

  <Card title="CSV import" icon="file-csv" href="/help/import-data">
    Live for all three. Use weekly while the live adapters are in flight.
  </Card>
</CardGroup>

A connected Front/Plain/Zendesk workspace doesn't auto-populate metrics yet. The token is there so the work to add a real adapter doesn't have to redo auth.

## Privacy

Same posture as [Intercom](/help/intercom): read-only scopes, AES-GCM encryption at rest, no conversation bodies stored. Tokens can be revoked from your helpdesk's developer settings and locally via `DELETE /integrations/connections?provider=<name>`.