Platform installations & heartbeat
Register a site from Dashboard → Integrations → Storefront & CMS connections, then authenticate heartbeat calls with the one-time secret. Verification moves from heartbeat → render → live as events arrive.
Public registry
GET /api/platforms/registry returns adapter metadata (including docsPath) for supported platforms.
Heartbeat
POST /api/integrations/platform-heartbeat with installationId, token (secret), event (ping, first_render, first_interaction, first_conversion), and optional sdkProduct / surface / origin.
Do not ship the secret in public storefront JavaScript — use a server, GTM server-side, or secure automation.
Stale installations
Scheduled job GET /api/cron/platform-installations-stale marks installs with old heartbeats as degraded. Configure CRON_SECRET in production (see vercel.json).