frappe-impl-integrations
Facilitates OAuth, webhooks, and payment gateway integrations in Frappe, ensuring secure data handling and seamless external service connections.
Install this skill
Security score
The frappe-impl-integrations skill was audited on May 28, 2026 and we found 31 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 380 | curl -X POST https://your-site.com/api/method/login \ |
Webhook reference - potential data exfiltration
| 4 | Use when implementing OAuth providers, Connected Apps, Webhooks, Payment Gateways, or Data Import/Export in Frappe. |
Webhook reference - potential data exfiltration
| 5 | Prevents authentication failures from wrong OAuth flow, missed webhook deliveries, and data corruption during bulk imports. |
Webhook reference - potential data exfiltration
| 6 | Covers OAuth2 provider/client, Connected App DocType, Webhook DocType, Payment Gateway integration, Data Import, Data Export, frappe.integrations module. |
Webhook reference - potential data exfiltration
| 7 | Keywords: OAuth, Connected App, Webhook, Payment Gateway, Data Import, Data Export, integration, API key, OAuth2, webhook trigger, connect to external service, OAuth setup, webhook configuration, impo |
Webhook reference - potential data exfiltration
| 17 | Step-by-step workflows for OAuth, Webhooks, Payment Gateways, Data Import/Export, and external API calls. |
Webhook reference - potential data exfiltration
| 29 | │ ├─► On document events → Webhook (push to external) |
Webhook reference - potential data exfiltration
| 47 | ├─► Real-time → Webhook or API endpoint |
Webhook reference - potential data exfiltration
| 156 | ## Workflow 3: Webhooks: Push Notifications to External Services |
Webhook reference - potential data exfiltration
| 158 | ### Step 1: Create Webhook DocType |
Webhook reference - potential data exfiltration
| 160 | Navigate to **Integrations > Webhook**: |
Webhook reference - potential data exfiltration
| 193 | ### Step 4: Enable Webhook Secret (HMAC Verification) |
Webhook reference - potential data exfiltration
| 195 | Set a **Webhook Secret** — Frappe adds `X-Frappe-Webhook-Signature` header with base64-encoded HMAC-SHA256 hash of the payload. |
Webhook reference - potential data exfiltration
| 202 | def verify_webhook(payload_body, secret, signature_header): |
Webhook reference - potential data exfiltration
| 211 | - **ALWAYS** enable Webhook Secret for production webhooks |
Webhook reference - potential data exfiltration
| 212 | - **NEVER** rely on webhooks for guaranteed delivery — implement idempotency on the receiver |
Webhook reference - potential data exfiltration
| 214 | - Webhook logs are created for every delivery — check **Webhook Request Log** for debugging |
Webhook reference - potential data exfiltration
| 393 | | Webhook | Push on event | Webhook DocType configuration | |
Webhook reference - potential data exfiltration
| 429 | | Webhook DocType | Yes | Yes | Yes | |
Webhook reference - potential data exfiltration
| 435 | | Webhook HMAC | Yes | Yes | Yes | |
External URL reference
| 92 | auth_url = https://your-frappe.com/api/method/frappe.integrations.oauth2.authorize |
External URL reference
| 93 | token_url = https://your-frappe.com/api/method/frappe.integrations.oauth2.get_token |
External URL reference
| 94 | api_url = https://your-frappe.com/api/method/frappe.integrations.oauth2.openid_profile |
External URL reference
| 121 | | Scopes | Permissions needed (e.g., `https://mail.google.com/`) | |
External URL reference
| 145 | response = session.get("https://www.googleapis.com/gmail/v1/users/me/messages") |
External URL reference
| 227 | "https://api.example.com/data", |
External URL reference
| 233 | "https://api.example.com/submit", |
External URL reference
| 248 | "https://api.example.com/endpoint", |
External URL reference
| 366 | https://your-site.com/api/resource/Sales%20Invoice |
External URL reference
| 373 | https://your-site.com/api/resource/Sales%20Invoice |
External URL reference
| 380 | curl -X POST https://your-site.com/api/method/login \ |