How to Integrate Lovable with GoToWebinar

Navigate to developer.goto.com and sign in with your GoTo account. Click 'My Apps' in the top navigation, then 'Add a New App'. Give your app a name like 'Lovable Webinar Integration'. Under 'Authorization Type', select 'Authorization Code' if you want per-user authorization (recommended for multi-user apps) or 'Client Credentials' for single-account server-to-server access. For the redirect URI in the Authorization Code flow, enter a URL you control — during initial setup, you can use a temporary service like httpbin.org/get or your deployed Lovable app URL with a callback path. You will use this URI once to complete the initial authorization and obtain a refresh token, after which the token can be used repeatedly by your Edge Function. After creating the app, copy the Client ID and Client Secret displayed on the app detail page. Also select the OAuth scopes your app needs — for GoToWebinar you need 'collab:webinar_management' and 'collab:webinar_registration'. Save the app. Your OAuth2 credentials are now ready to store in Lovable Secrets.

GoToWebinar's Authorization Code flow requires an initial browser-based authorization before your Edge Function can make API calls. Complete this once: build the authorization URL with your Client ID, redirect URI, and scope, then open it in a browser. Sign in to GoTo and approve the authorization. You will be redirected to your redirect URI with a code parameter in the URL. Exchange this code for tokens by calling https://authentication.logmeininc.com/oauth/token with grant_type=authorization_code. The response includes access_token, refresh_token, expires_in, and account_key. The access token expires in 3600 seconds (1 hour), but the refresh token is long-lived and can be exchanged for new access tokens indefinitely. In Lovable's Cloud tab → Secrets, add the following: GOTO_CLIENT_ID (your app's client ID), GOTO_CLIENT_SECRET (your app's client secret), GOTO_REFRESH_TOKEN (the refresh token from authorization), and GOTO_ACCOUNT_KEY (the numeric account key from the token response). Your Edge Function will use the refresh token to generate fresh access tokens — you never need to repeat the browser authorization step.

Create two Edge Functions: one for webinar creation and listing (gotowebinar-manage) and one for attendee registration (gotowebinar-register). Both functions follow the same pattern: first refresh the access token using the stored refresh token, then call the appropriate GoToWebinar API endpoint. The token refresh call is a POST to https://authentication.logmeininc.com/oauth/token with grant_type=refresh_token, client_id, client_secret, and refresh_token. This returns a new access_token. The GoToWebinar API base URL for webinar management is https://api.getgo.com/G2W/rest/v2/accounts/{accountKey}/webinars. For webinar creation, POST to that endpoint with subject, description, times array (startTime, endTime in ISO 8601), timezone, and type ('single_session' or 'series'). The response includes webinarKey which identifies the webinar. For registration, POST to /webinars/{webinarKey}/registrants with firstName, lastName, email, and any custom registration fields. The response includes a joinUrl for the registered attendee. Ask Lovable to generate both functions with the token refresh logic built in. The refresh pattern should happen at the start of every function invocation to ensure a valid access token.

1// supabase/functions/gotowebinar-manage/index.ts
2import { serve } from 'https://deno.land/std@0.168.0/http/server.ts';
3
4const corsHeaders = {
5  'Access-Control-Allow-Origin': '*',
6  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
7};
8
9async function getAccessToken(): Promise<string> {
10  const clientId = Deno.env.get('GOTO_CLIENT_ID')!;
11  const clientSecret = Deno.env.get('GOTO_CLIENT_SECRET')!;
12  const refreshToken = Deno.env.get('GOTO_REFRESH_TOKEN')!;
13
14  const credentials = btoa(`${clientId}:${clientSecret}`);
15  const res = await fetch('https://authentication.logmeininc.com/oauth/token', {
16    method: 'POST',
17    headers: {
18      'Authorization': `Basic ${credentials}`,
19      'Content-Type': 'application/x-www-form-urlencoded',
20    },
21    body: `grant_type=refresh_token&refresh_token=${encodeURIComponent(refreshToken)}`,
22  });
23
24  if (!res.ok) throw new Error(`GoTo auth error: ${await res.text()}`);
25  const data = await res.json();
26  return data.access_token;
27}
28
29serve(async (req) => {
30  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders });
31
32  try {
33    const accountKey = Deno.env.get('GOTO_ACCOUNT_KEY')!;
34    const { action, ...body } = await req.json();
35    const token = await getAccessToken();
36    const baseUrl = `https://api.getgo.com/G2W/rest/v2/accounts/${accountKey}/webinars`;
37
38    if (action === 'list') {
39      const res = await fetch(
40        `${baseUrl}?fromTime=${new Date().toISOString()}&toTime=${new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString()}`,
41        { headers: { 'Authorization': `Bearer ${token}` } }
42      );
43      const data = await res.json();
44      return new Response(JSON.stringify(data), { headers: { ...corsHeaders, 'Content-Type': 'application/json' } });
45    }
46
47    if (action === 'create') {
48      const { subject, description, startTime, endTime, timezone } = body;
49      const res = await fetch(baseUrl, {
50        method: 'POST',
51        headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
52        body: JSON.stringify({
53          subject,
54          description,
55          times: [{ startTime, endTime }],
56          timeZone: timezone,
57          type: 'single_session',
58        }),
59      });
60      const data = await res.json();
61      if (!res.ok) throw new Error(`Create error: ${JSON.stringify(data)}`);
62      return new Response(JSON.stringify(data), { headers: { ...corsHeaders, 'Content-Type': 'application/json' } });
63    }
64
65    throw new Error('Invalid action');
66  } catch (error) {
67    return new Response(
68      JSON.stringify({ error: error.message }),
69      { status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' } }
70    );
71  }
72});

Create the gotowebinar-register Edge Function that handles attendee registration. This function accepts first name, last name, email, and the webinarKey, then POST to https://api.getgo.com/G2W/rest/v2/webinars/{webinarKey}/registrants. The response contains the registrantKey and joinUrl — store both in your Supabase registrants table. With both functions deployed, use Lovable's chat to build the frontend components. A webinar listing page calls gotowebinar-manage with action='list' to display upcoming webinars. A registration form per webinar calls gotowebinar-register. Store registrations in Supabase so you can also send follow-up emails independently of GoToWebinar's own email system. For the registration page, show the webinar title, date, description, and a form. After successful registration, display the join link prominently and optionally add it to the user's profile or send it via Resend. Handle errors gracefully — GoToWebinar returns 400 if the email is already registered for that webinar, which you should display as a friendly message ('You are already registered — check your email for the join link').