How to Integrate Lovable with Autopilot (Ortto)

Log in to your Ortto account at ortto.com and navigate to Settings (gear icon in the top right). In the Settings menu, look for the API section or Integrations → API. Your API key is displayed on this page as a long string. If you have not yet generated an API key, click Generate New Key. Ortto may show multiple API keys if you have created more than one — use the one labeled for your primary workspace. The API key is passed in the Authorization header as 'Bearer {api-key}' for all Ortto API requests. Ortto's API base URL is https://api.ap3api.com for the Autopilot (legacy) endpoints or https://api.ortto.com for newer Ortto API endpoints. Check your account's documentation section to confirm which base URL applies to your account — older Autopilot accounts may use the legacy URLs. Copy your API key and do not share it publicly.

In your Lovable project, click the plus (+) icon next to the preview panel to open the side panels. Click the Cloud tab and scroll to the Secrets section. Click Add Secret. In the Name field, enter ORTTO_API_KEY. Paste your Ortto API key into the Value field. Click Save. The key is now encrypted and only accessible from Edge Functions. Lovable's security system actively prevents API keys from being hardcoded into frontend code — approximately 1,200 keys are blocked daily from being committed to application code — and using Cloud Secrets is the correct pattern. Never paste your Ortto API key into Lovable's chat interface, as on the free plan chat history is publicly accessible.

Create the Edge Function that proxies contact and activity operations to Ortto. The function accepts POST requests with a JSON body specifying the operation type (upsert_contact, log_activity), the contact email, and relevant data fields. For contact upserts, it calls Ortto's person/merge endpoint. For activity logging, it calls the activity endpoint. Include proper error handling for Ortto API errors and CORS headers for browser requests. The function uses the Ortto API key from Cloud Secrets in the Authorization header for all calls. Ortto's person merge endpoint accepts fields like email, first_name, last_name, and any custom fields defined in your Ortto account. Custom activities require an activity type name (which must be created in Ortto's activity catalog first) and can include arbitrary key-value attributes.

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2
3const corsHeaders = {
4  'Access-Control-Allow-Origin': '*',
5  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
6}
7
8const ORTTO_BASE = 'https://api.ap3api.com'
9
10serve(async (req) => {
11  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders })
12
13  try {
14    const apiKey = Deno.env.get('ORTTO_API_KEY')
15    if (!apiKey) throw new Error('ORTTO_API_KEY not configured')
16
17    const { operation, email, first_name, last_name, custom_fields, activity_name, activity_attributes } = await req.json()
18
19    let orttoUrl: string
20    let orttoBody: any
21
22    if (operation === 'upsert_contact') {
23      orttoUrl = `${ORTTO_BASE}/v1/person/merge`
24      orttoBody = {
25        people: [{
26          fields: {
27            'str::email': email,
28            'str::first': first_name || '',
29            'str::last': last_name || '',
30            ...(custom_fields || {}),
31          },
32          async: false,
33        }],
34        merge_by: ['str::email'],
35        merge_strategy: 1,
36        find_strategy: 0,
37      }
38    } else if (operation === 'log_activity') {
39      orttoUrl = `${ORTTO_BASE}/v1/activities/create`
40      orttoBody = {
41        activities: [{
42          activity_id: `act:cm:${activity_name.toLowerCase().replace(/\s+/g, '-')}`,
43          attributes: {
44            'str::email': email,
45            ...(activity_attributes || {}),
46          },
47        }],
48      }
49    } else {
50      return new Response(
51        JSON.stringify({ error: 'Unknown operation. Use upsert_contact or log_activity.' }),
52        { status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
53      )
54    }
55
56    const response = await fetch(orttoUrl, {
57      method: 'POST',
58      headers: {
59        'Authorization': `Bearer ${apiKey}`,
60        'Content-Type': 'application/json',
61      },
62      body: JSON.stringify(orttoBody),
63    })
64
65    const data = await response.json()
66    return new Response(JSON.stringify(data),
67      { headers: { ...corsHeaders, 'Content-Type': 'application/json' } })
68  } catch (error) {
69    return new Response(JSON.stringify({ error: error.message }),
70      { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } })
71  }
72})

With the Edge Function deployed, wire it into key user lifecycle events in your Lovable app. The three most important events to capture are: signup (call upsert_contact when a user registers), key feature activation (call log_activity when a user first uses an important feature), and plan change (call upsert_contact with updated plan attributes when a user upgrades or downgrades). For each of these, call the ortto-proxy Edge Function using Supabase's functions.invoke() method with the appropriate operation and data. These calls should be fire-and-forget — do not await them in user-facing code paths so they do not slow down the user experience. Add them in a useEffect or event handler that runs asynchronously after the primary action completes successfully.

1import { supabase } from '@/integrations/supabase/client'
2
3export const syncToOrtto = (operation: string, data: Record<string, any>) => {
4  // Fire-and-forget — never awaited in user-facing code
5  supabase.functions.invoke('ortto-proxy', { body: { operation, ...data } })
6    .then(({ error }) => { if (error) console.warn('Ortto sync failed:', error) })
7    .catch(e => console.warn('Ortto sync error:', e))
8}
9
10// Usage in signup handler:
11// syncToOrtto('upsert_contact', { email, first_name, last_name })
12// syncToOrtto('log_activity', { email, activity_name: 'App Signup', activity_attributes: { plan: 'free' } })