SkySlope Integration Hub

Blue Chariot · SkySlope Forms & DTM

Forms Endpoint

SkySlope Forms & DTM Integration

OAuth 2.0 PKCE callback, document signing webhooks, and Digital Transaction Management — secured for Blue Chariot administrators.

OAuth 2.0 + PKCE

Forms Callback

Authorization-code flow with PKCE (RFC 7636). Single-use state, AES-256-GCM encrypted token storage, automatic refresh.

/auth/skyslope/forms/callback
Webhook Endpoint

Signing Notifications

Receives document signing status events with signature verification. Raw payloads stay server-side; only metadata is shown.

/webhooks/skyslope/forms
DTM Credentials

Direct Auth

SkySlope DTM uses dedicated API credentials stored as server secrets — no redundant OAuth callback.

Security Posture

  • Administrative actions (token clear, diagnostics, refresh) require a signed-in Blue Chariot administrator verified server-side viahas_role('admin').
  • Public OAuth callback and webhook POST endpoints remain reachable without an interactive login.
  • OAuth state is single-use and replay-proof; tokens are encrypted at rest.
  • Webhook signature verification rejects unsigned or mismatched requests.