Getting started

Homa Meta Platform is a stateless integration layer. It owns the authorization handshake with Meta and hands normalised events to Homa CRM. No Meta credential ever reaches the browser.

Public web tier

This website. Serves marketing, legal and developer documentation, plus the /connect entry point that starts an authorization request.

Authorization service

A server-only route that builds the Meta authorization URL, sets a signed state cookie and later exchanges the authorization code for a token. Runs exclusively on the server.

Webhook receiver

An HTTPS endpoint that verifies each payload signature, deduplicates events and enqueues them for processing.

Token store

Encrypted storage for long-lived tokens, scoped per tenant. Tokens are never logged or returned to a client.

Homa CRM

The consuming product. Receives normalised conversations, comments and contact records through internal APIs.

1. A signed-in Homa CRM user opens /connect on this site.
2. The user accepts the Privacy Policy and Terms of Service. The submit control stays disabled until both are accepted.
3. The browser POSTs to a server route. That route generates a random state value, stores it in an HttpOnly cookie and redirects to Meta.
4. The user authenticates with Meta directly and chooses which eligible assets to authorize. Homa never sees these credentials.
5. Meta redirects back to the configured redirect URI with an authorization code.
6. The server validates the returned state against the cookie, then exchanges the code for an access token over a server-to-server call.
7. The token is encrypted and stored against the tenant. The user lands on /authorized.

Create an app in the Meta App Dashboard, then configure the values below. Use two separate apps so development traffic can never write to production data.

Only NEXT_PUBLIC_ prefixed values are available to browser code. Everything else is server-only. Copy .env.example to .env.local for development.

# Public — safe to expose to the browser
NEXT_PUBLIC_SITE_URL=https://meta.homacrm.com
NEXT_PUBLIC_HOMA_URL=https://www.homacrm.com

# Server-only — the authorization endpoint and app identity
META_AUTHORIZATION_URL=
META_APP_ID=
META_REDIRECT_URI=https://meta.homacrm.com/authorized

# Server-only — never expose or prefix with NEXT_PUBLIC_
META_APP_SECRET=

# Transactional email for the contact and deletion forms
RESEND_API_KEY=
CONTACT_EMAIL=support@homacrm.com
DATA_DELETION_EMAIL=privacy@homacrm.com
SUPPORT_EMAIL=support@homacrm.com
SECURITY_EMAIL=security@homacrm.com

The site degrades gracefully when optional variables are absent. If META_AUTHORIZATION_URL is not set, /connect explains that authorization is not configured yet instead of failing. If RESEND_API_KEY is not set, the forms show the fallback email address and a reference number rather than reporting a delivery that never happened.

• Use a separate Meta app for development, with its own app ID, secret and redirect URI.
• Point the development redirect URI at your local or preview host, and register it in that app only.
• Never share a token store between environments. A development token must not be able to read production conversations.
• Use distinct webhook verify tokens per environment so a misrouted subscription fails loudly instead of writing to the wrong tenant.
• Keep test business assets separate from customer assets. Do not authorize a live customer Page from a development app.