Canny Integration for Feature Requests on Your Site

Feature requests scattered across email, messengers, and ticketing systems—impossible to prioritize. The team spends up to 10 hours a week collecting and classifying instead of developing. Canny solves this by providing a unified window for collecting, voting, and tracking request status. We have implemented over 50 Canny integrations for projects of various scales—from startups to enterprise—ensuring seamless embedding into existing infrastructure. Our engineers with five years of experience have helped clients reduce feature request collection time by 70% and increase request conversion by 40% after SSO setup.

Let's break down how to embed Canny into a web application with React frontend and Laravel backend, set up SSO via JWT, and automatically notify users of changes via webhooks. Proper SSO configuration is key: after implementation, the number of feature requests from users grows by an average of 40%.

How to set up SSO via JWT for seamless authentication?

Canny supports SSO via JWT so users don't have to create a separate account. More details in Canny documentation.

Step 1: Generate JWT token on the server

// CannyTokenController
public function generate(): JsonResponse
{
    $user = auth()->user();

    $userData = [
        'avatarURL' => $user->avatar_url,
        'email'     => $user->email,
        'id'        => (string) $user->id,
        'name'      => $user->name,
        // Опционально: companies для B2B сегментации
        'companies' => [[
            'id'   => (string) $user->company_id,
            'name' => $user->company->name,
        ]],
    ];

    $token = \Firebase\JWT\JWT::encode(
        ['userData' => $userData],
        config('services.canny.private_key'),
        'HS256'
    );

    return response()->json(['token' => $token]);
}

It is important to check the token's expiration and refresh it when user data changes (role, company). Set TTL to no more than 24 hours and use a refresh mechanism. This configuration reduces the risk of token leakage and ensures security.

Step 2: Embed the widget in a React application

// В React-компоненте
useEffect(() => {
  // Загрузка Canny SDK
  (function(w, d, i, s) {
    // ... Canny SDK loader
  })(window, document, 'Canny', 'https://cdn.canny.io/sdk.js');

  const initCanny = async () => {
    const { token } = await fetch('/api/canny-token').then(r => r.json());

    window.Canny('identify', {
      appID: process.env.NEXT_PUBLIC_CANNY_APP_ID,
      user:  { ssoToken: token },
    });

    window.Canny('render', {
      boardToken: 'YOUR_BOARD_TOKEN',
      basePath:   '/feedback',
      ssoToken:   token,
    });
  };

  initCanny();
}, []);

If the user is not authenticated, the widget does not render; instead, show a link to the login page. Use Intersection Observer for lazy loading. This reduces initial page load and improves Core Web Vitals.

Step 3: Handle webhooks

Canny sends webhooks when a request status changes:

Route::post('/webhooks/canny', function (Request $request) {
    // Верификация подписи
    $signature = hash_hmac('sha256', $request->getContent(), config('services.canny.webhook_secret'));
    if (!hash_equals($signature, $request->header('Canny-Signature'))) abort(401);

    $event = $request->json('type');
    $post  = $request->json('object');

    if ($event === 'post.statusChanged' && $post['status'] === 'complete') {
        // Уведомляем всех проголосовавших по email
        // Canny делает это автоматически, но можно добавить собственную логику
        Log::info("Canny feature completed: {$post['title']}");
    }

    return response('ok');
});

In case of processing errors (network or logical), configure retry — Canny retries requests within 24 hours. Add monitoring of failed webhooks queue through Laravel Horizon. Without proper webhook handling, you risk missing up to 15% of updates.

Typical integration phase timelines

Why Canny is better than in-house development?

Canny pays off through speed—you get a ready-made platform for collecting feature requests without development and support costs. Comparing costs, an in-house solution will cost at least three times more for similar functionality.

How to ensure stable webhook processing?

For reliable webhook processing, configure retry on failures and monitoring via Laravel Horizon. Ensure signature verification protects against fake requests. If webhooks stop arriving, check the SSL certificate and endpoint availability.

What's included in Canny integration

• SSO setup (JWT authentication with your user database)
• Widget embedding (React, Vue, Angular, or vanilla JS)
• Webhook configuration (notifications on status changes)
• Appearance customization (colors, logo, texts)
• Documentation (integration scheme, endpoint description)
• Team training (working with board, prioritization)
• Technical support during launch

We guarantee that the integration will not disrupt existing authentication and security processes. Order a turnkey integration from us—get an engineer consultation.

Timelines and cost

Basic integration (SSO + widget + one webhook) takes 1 to 3 business days. If multiple widgets, customization, or backend modifications are needed, timelines are negotiated individually. The cost is calculated based on the scope of work—contact us for a project estimate.

Typical mistakes when integrating Canny

Common problems and their solutions:

• Incorrect JWT configuration — missing id field or wrong signing algorithm. Always test the token in the Canny admin panel.
• Omitting webhook verification — without signature check, you can accept fake requests.
• Ignoring the role model — Canny allows differentiating admin and regular user permissions via companies.

Avoiding these mistakes will ensure stable feature request collection. If you doubt your implementation, order a turnkey integration with us.

Website CRM Integration: Bitrix24, amoCRM, Salesforce, HubSpot

A sales manager manually copies leads from email into the CRM. Half of them never make it. Follow‑up calls are missed. This isn’t a people problem — it’s an architectural gap between the website and the company’s core system. We close that gap with a direct site‑to‑CRM connection: leads land in the pipeline within 30 seconds after form submission, duplication is blocked, and status changes flow both ways automatically. Request a free integration audit to identify the bottlenecks in your current flow.

Integration isn’t just a POST to an API endpoint. It’s a battle against timeouts, duplicate records, data loss, and desynchronised states. We handle three core problems at once: asynchronous delivery (so the user never waits for the CRM), deduplication by email (one address – one lead), and two‑way feedback (a status change in the CRM instantly appears on the site). Below is how we tackle each.

Bitrix24: REST API and Event Handlers

Bitrix24 dominates the Russian B2B space. Its REST API works via OAuth 2.0 or an incoming webhook (webhook is simpler but less secure for production). Main entities are lead, deal, contact, and company.

Creating a lead requires POST /rest/crm.lead.add with the correct field set. Attaching it to a funnel means passing SOURCE_ID. Adding a timeline comment uses crm.timeline.comment.add. Real‑time tracking is done through Event Handlers: register a hook with event.bind; Bitrix24 pushes a POST to your endpoint when any deal status changes.

The real complexity lies in custom fields. Every Bitrix24 installation has its own set, and their IDs must be fetched via crm.lead.fields. Mapping those fields between the site and the CRM can be done manually or automatically — we use an automatic detection mechanism that works even in non‑standard configurations (proven on 20+ projects). We guarantee correct matching, so no lead arrives without the right pipeline stage or source tag.

amoCRM: Clean REST with Predictable Endpoints

amoCRM (now Kommo for international markets) offers a cleaner API. OAuth 2.0 with refresh token, JSON API, and well‑structured endpoints. Pipelines are pipelines, deals are leads, contacts are contacts.

A common mistake: when creating a deal you must supply pipeline_id and status_id explicitly. Without them the deal lands in the default pipeline – often the wrong one. Tags for source classification go into _embedded.tags. Incoming webhooks are configured in the admin panel; they support add, update, delete, status, and note events. We always verify the webhook signature using the API key and make sure the endpoint responds with 200 OK in under 5 seconds – otherwise the CRM marks delivery as failed.

Salesforce and HubSpot: Enterprise‑Grade Integration

Salesforce is the enterprise standard. It offers REST API, SOQL for complex queries, and Apex for server‑side logic. Integration can be direct via Salesforce REST API or through middleware like Zapier or MuleSoft. For PHP projects we use phpforce/soap-client or the Force.com‑Toolkit. The main challenge is mapping hundreds of custom objects and fields; we solve it with Describe Global to collect metadata automatically – cutting setup time by three‑quarters compared to reading documentation manually (Salesforce Developer Guide).

HubSpot is popular among SaaS companies and international B2B. Its API v3 provides a REST interface with solid SDKs for PHP and Node.js (@hubspot/api-client). Contacts, Companies, Deals are standard objects. The Forms API lets you send data from any custom form directly to HubSpot without using the native widget. One pitfall: the access_token must include the right scopes; a misconfigured token returns 403 Forbidden with a vague message. We include error_logging that captures the error code – debugging takes minutes instead of hours.

Which CRM fits your business: Bitrix24, amoCRM, or HubSpot?

Why is asynchronous sending important?

Calling a CRM API synchronously from the form handler is a mistake. The API may respond in 2 seconds – or time out. The user sits waiting. The correct pattern: form submission → save to database → queue a job → return 200 to the user immediately. A background worker then pushes the lead to the CRM. If the CRM is down, the worker retries with exponential backoff. We use Redis + Bull on Node.js or Laravel Queue on PHP – this guarantees delivery even during temporary outages.

Deduplication – how we stop duplicate leads

The same contact may fill the form twice. Without deduplication the CRM ends up with two identical leads. Before creating a new lead we search by email: for Bitrix24 we call crm.duplicate.findByComm, for HubSpot we use contacts/search. If a match is found we attach a task or comment to the existing lead instead of creating a new one. In our projects this cuts duplicate entries by 95%.

Two‑way synchronization – what happens when a manager changes a deal status

If a manager updates a deal status in the CRM, the website needs to reflect that change – especially if the client has a personal account. We configure webhooks from the CRM to an endpoint on the site, then update the local database and notify the client. Critical details: verify the webhook signature and respond with 200 OK within 5 seconds, otherwise the CRM assumes delivery failed. We guarantee that the delay between a status change in the CRM and its appearance on the site never exceeds 3 seconds.

How do we conduct integration in 5 steps?

1. Audit of data flows – analyse current lead transfer, CRM field structure, and performance bottlenecks. Deliverable: “as‑is” and “to‑be” data flow diagrams.
2. Architecture design – choose the queue mechanism (Redis Bull or Laravel Queue), define the deduplication method, and prepare a field mapping specification.
3. Implementation on staging – write code on Laravel or Node.js, configure webhooks, and test with real data: lead creation, status updates, and error handling.
4. Load testing – simulate peak traffic (e.g. 500 requests per minute) and adjust retry policies and timeout settings.
5. Deployment and documentation – push to production, train the team on monitoring and retry cleanup, and deliver full endpoint documentation.

What is included in the work

• Audit report with current data flow diagrams and typical error patterns.
• Architecture design document specifying queue, deduplication, and mapping.
• Production‑ready integration code on Laravel or Node.js.
• Webhook configuration and signature verification.
• Team training on support tasks and retry cleanup.
• 30‑day warranty support for bug fixes and mapping adjustments.

Real‑world case: real‑estate agency with 400 leads per month

Timelines

The exact cost is calculated after an audit of your current processes and CRM data structure. Contact us for a project estimate – we will send a commercial proposal within one business day. With 5+ years of experience and more than 20 completed integrations, you get a solution that works from day one. Get an engineer consultation to see how your sales funnel can run without manual lead transfer.

Additional sources: Customer relationship management (Wikipedia) · REST API (Wikipedia)