intercom-security-basics

# Intercom Security Basics ## Overview Security best practices for Intercom access tokens, webhook signature verification, Identity Verification (HMAC), and least-privilege OAuth scopes. ## Prerequisites - Intercom access token or OAuth credentials - Understanding of HMAC cryptographic signatures - Access to Intercom Developer Hub ## Instructions ### Step 1: Secure Token Storage ```bash # .env (NEVER commit to git) INTERCOM_ACCESS_TOKEN=dG9rOmFiY2RlZmdoaQ== INTERCOM_WEBHOOK_SECRET=your-webhook-signing-secret INTERCOM_IDENTITY_SECRET=your-identity-verification-secret # .gitignore (mandatory entries) .env .env.local .env.*.local ``` Verify no tokens are committed: ```bash # Scan git history for leaked tokens git log --all -p | grep -i "INTERCOM_ACCESS_TOKEN\|dG9r" | head -5 # If found: rotate token immediately, then use git-filter-repo to remove ``` ### Step 2: Webhook Signature Verification (X-Hub-Signature) Intercom signs webhook notifications with HMAC-SHA1 using `X-Hub-Signature`. You must verify this on every incoming webhook. ```typescript import crypto from "crypto"; import express from "express"; function verifyIntercomWebhook( payload: Buffer, signature: string, secret: string ): boolean { // Intercom uses X-Hub-Signature with HMAC-SHA1 const expectedSignature = "sha1=" + crypto .createHmac("sha1", secret) .update(payload) .digest("hex"); // Timing-safe comparison to prevent timing attacks return crypto.timingSafeEqual( Buff...