How to Integrate Lovable with Infusionsoft by Keap

OAuth2 authentication for Infusionsoft uses the Keap Developer portal, which covers both the legacy Infusionsoft (Keap Max Classic) and the modern Keap product. Go to developer.infusionsoft.com and sign in with your Infusionsoft/Keap account. Click 'Register Application'. Fill in: - Application Name: 'Lovable Integration' - Description: something descriptive - Redirect URL: https://yourapp.lovable.app/oauth/callback (for the initial token exchange) - Application Type: Server (for OAuth2 client credentials/authorization code) After registration, you receive a Client ID and Client Secret. Copy both. Next, generate the initial access and refresh tokens via the OAuth2 authorization code flow. Construct the authorization URL: https://accounts.infusionsoft.com/app/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=YOUR_REDIRECT_URI&response_type=code&scope=full Open this URL in your browser and authorize the application. Infusionsoft redirects to your redirect URI with a 'code' parameter. Copy the code. Exchange the code for tokens: POST to https://api.infusionsoft.com/token with: - grant_type: authorization_code - client_id: your client ID - client_secret: your client secret - redirect_uri: your redirect URI - code: the authorization code Use Postman or Hoppscotch to make this request as form URL-encoded. The response includes access_token, refresh_token, token_type, and expires_in (86400 seconds = 24 hours). Note your Infusionsoft app name (the subdomain in yourappname.infusionsoft.com). Some API operations require passing the application name.

Add all credentials to Lovable's Cloud Secrets panel. In Lovable, click '+' → Cloud panel → Secrets. Add: - KEAP_CLIENT_ID — your application's Client ID from the developer portal - KEAP_CLIENT_SECRET — your application's Client Secret - KEAP_ACCESS_TOKEN — the current access token (valid for 24 hours) - KEAP_REFRESH_TOKEN — the long-lived refresh token (expires after 90 days of non-use) For tag-based automation, you also need the numeric tag IDs for your key segments. In Infusionsoft, go to CRM → Settings → Tags. Each tag shows its ID — a numeric value like 123 or 4567. Make a list of the tag IDs you will use: Store frequently-used tag IDs as additional secrets: - KEAP_TAG_NEW_SIGNUP — tag ID applied when users sign up - KEAP_TAG_TRIAL_ACTIVE — tag ID for active trial users - KEAP_TAG_TRIAL_EXPIRED — tag ID for expired trials - KEAP_TAG_CUSTOMER — tag ID for paying customers This approach means tag ID changes in Infusionsoft only require secret updates, not code changes in your Edge Functions. The Keap REST API base URL is https://api.infusionsoft.com/crm/rest/v1/ for the REST API.

Build the Edge Function that handles Infusionsoft/Keap operations with automatic OAuth2 token refresh. The Keap REST API v1 uses Bearer token authentication, similar to other OAuth2 APIs. Keap REST API key endpoints: - GET /crm/rest/v1/contacts — search contacts - POST /crm/rest/v1/contacts — create contact - PATCH /crm/rest/v1/contacts/{contactId} — update contact - POST /crm/rest/v1/contacts/{contactId}/tags — apply tags - DELETE /crm/rest/v1/contacts/{contactId}/tags — remove tags - GET /crm/rest/v1/tags — list all tags - GET /crm/rest/v1/opportunities — list opportunities For searching contacts by email: GET /crm/rest/v1/contacts?email=user@example.com. This returns a contacts array — check if any match before creating a new one. For applying tags: POST /crm/rest/v1/contacts/{contactId}/tags with body { tagIds: [123, 456] }. Note: tagIds (plural) is an array. The token refresh endpoint is POST https://api.infusionsoft.com/token with grant_type=refresh_token, client_id, client_secret, and refresh_token. The response includes a new access_token (and sometimes a new refresh_token — if a new refresh token is provided, the old one is invalidated, so you must update your stored value).

1import { serve } from 'https://deno.land/std@0.168.0/http/server.ts'
2
3const corsHeaders = {
4  'Access-Control-Allow-Origin': '*',
5  'Access-Control-Allow-Headers': 'authorization, x-client-info, apikey, content-type',
6}
7
8const KEAP_BASE = 'https://api.infusionsoft.com/crm/rest/v1'
9
10async function refreshKeapToken(): Promise<string> {
11  const resp = await fetch('https://api.infusionsoft.com/token', {
12    method: 'POST',
13    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
14    body: new URLSearchParams({
15      grant_type: 'refresh_token',
16      client_id: Deno.env.get('KEAP_CLIENT_ID')!,
17      client_secret: Deno.env.get('KEAP_CLIENT_SECRET')!,
18      refresh_token: Deno.env.get('KEAP_REFRESH_TOKEN')!,
19    }),
20  })
21  const data = await resp.json()
22  if (!data.access_token) throw new Error('Keap token refresh failed')
23  return data.access_token
24}
25
26async function keapFetch(path: string, method = 'GET', body?: unknown, retry = true): Promise<Response> {
27  let token = Deno.env.get('KEAP_ACCESS_TOKEN')!
28  let resp = await fetch(`${KEAP_BASE}${path}`, {
29    method,
30    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
31    body: body ? JSON.stringify(body) : undefined,
32  })
33  if (resp.status === 401 && retry) {
34    token = await refreshKeapToken()
35    resp = await fetch(`${KEAP_BASE}${path}`, {
36      method,
37      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
38      body: body ? JSON.stringify(body) : undefined,
39    })
40  }
41  return resp
42}
43
44serve(async (req) => {
45  if (req.method === 'OPTIONS') return new Response('ok', { headers: corsHeaders })
46
47  try {
48    const { action, params = {} } = await req.json()
49    let resp: Response
50
51    switch (action) {
52      case 'find_or_create_contact': {
53        // First try to find by email
54        const searchResp = await keapFetch(`/contacts?email=${encodeURIComponent(params.email)}`)
55        const searchData = await searchResp.json()
56        if (searchData.contacts?.length > 0) {
57          return new Response(JSON.stringify({ contactId: searchData.contacts[0].id, created: false }), {
58            headers: { ...corsHeaders, 'Content-Type': 'application/json' },
59          })
60        }
61        // Create if not found
62        resp = await keapFetch('/contacts', 'POST', {
63          given_name: params.firstName,
64          family_name: params.lastName,
65          email_addresses: [{ email: params.email, field: 'EMAIL1' }],
66          phone_numbers: params.phone ? [{ number: params.phone, field: 'PHONE1' }] : [],
67          company: { company_name: params.company || '' },
68          tag_ids: params.tagIds || [],
69        })
70        const created = await resp.json()
71        return new Response(JSON.stringify({ contactId: created.id, created: true }), {
72          headers: { ...corsHeaders, 'Content-Type': 'application/json' },
73        })
74      }
75
76      case 'apply_tags':
77        resp = await keapFetch(`/contacts/${params.contactId}/tags`, 'POST', { tagIds: params.tagIds })
78        break
79
80      case 'remove_tags':
81        resp = await keapFetch(`/contacts/${params.contactId}/tags`, 'DELETE', { tagIds: params.tagIds })
82        break
83
84      case 'list_tags':
85        resp = await keapFetch('/tags?limit=200')
86        break
87
88      default:
89        return new Response(JSON.stringify({ error: 'Unknown action' }), {
90          status: 400, headers: { ...corsHeaders, 'Content-Type': 'application/json' },
91        })
92    }
93
94    const data = await resp.json()
95    return new Response(JSON.stringify(data), {
96      status: resp.ok ? 200 : resp.status,
97      headers: { ...corsHeaders, 'Content-Type': 'application/json' },
98    })
99  } catch (error) {
100    return new Response(JSON.stringify({ error: error.message }), {
101      status: 500, headers: { ...corsHeaders, 'Content-Type': 'application/json' },
102    })
103  }
104})

With the Edge Function deployed, connect it to the key events in your Lovable app where tag-based automation should trigger. The pattern is consistent: detect the event in your React component or server-side logic, call the Edge Function with the contact's email and the relevant tag IDs, and let Infusionsoft's automation engine handle the follow-up sequences. For user registration: call find_or_create_contact after Supabase Auth creates the account, then apply the KEAP_TAG_NEW_SIGNUP tag. Use the fire-and-forget pattern (no await) so Infusionsoft sync does not delay the registration success response. For trial expiry: create a Supabase database function or scheduled Edge Function that runs daily, queries users whose trial_expires_at is in the past, and calls apply_tags with the KEAP_TAG_TRIAL_EXPIRED tag for each affected user's Infusionsoft contact. For subscription upgrades: in your payment webhook handler (or Supabase triggers on subscription updates), call apply_tags with KEAP_TAG_CUSTOMER and remove_tags with KEAP_TAG_TRIAL_ACTIVE. This atomic tag swap stops the trial nurture sequence and starts the customer success sequence simultaneously. Store the Infusionsoft contact ID in your Supabase users table after the first find_or_create call. Subsequent tag operations use the contact ID directly rather than searching by email each time — this avoids a search API call on every event.