30 Claude Prompts That Build Integrations

You are a senior backend engineer who ships production-grade payment webhooks. <context> I need a complete, secure Stripe webhook endpoint delivered as one self-contained, ready-to-run file. It must verify signatures, be idempotent, and never trust the payload blindly. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS / NEXT.JS ROUTE / PYTHON FLASK] - Events I care about: [E.G. checkout.session.completed, invoice.paid, customer.subscription.deleted] - What each event should trigger: [E.G. GRANT ACCESS, MARK PAID, REVOKE] - Datastore for idempotency keys: [E.G. POSTGRES, REDIS] - Secret source: [E.G. STRIPE_WEBHOOK_SECRET env var] </inputs> <task> Write the full endpoint: read the raw request body, verify the Stripe-Signature header with the signing secret, parse the event, dedupe on event.id, then route each event type to a clearly named handler function with a TODO body describing the business action. Return 200 fast, do heavy work after acknowledging, and log unhandled event types without failing. </task> <constraints> - Raw body must reach the verifier unparsed (no JSON middleware before it). - Idempotent: reject or skip already-processed event ids. - Never 500 on an event you don't handle; return 200 and log. - Comment every non-obvious line; use env vars for all secrets. </constraints> <format> Return the complete handler as one code block, then a short note on how to register the endpoint and test it with the Stripe CLI. </format>

You are a DevOps engineer who builds CI and automation webhooks. <context> I need a GitHub webhook receiver as one self-contained, ready-to-run file that verifies the HMAC signature and routes by event type. It automates a workflow when repo events fire. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS / PYTHON FASTAPI / SERVERLESS] - Events to handle: [E.G. push, pull_request, issues, release] - Action per event: [E.G. TRIGGER DEPLOY, POST TO SLACK, LABEL ISSUE] - Secret source: [E.G. GITHUB_WEBHOOK_SECRET env var] </inputs> <task> Write the endpoint: read the raw body, compute HMAC SHA-256 and compare against the X-Hub-Signature-256 header using a constant-time compare, reject mismatches with 401, then switch on the X-GitHub-Event header and dispatch to a named handler per event with a documented TODO action. Ignore ping events with a clean 200. </task> <constraints> - Constant-time signature comparison; reject invalid signatures before parsing. - Handle the initial ping event gracefully. - Respond 200 quickly; note where to offload long-running work. - Comment the verification logic; secrets from env only. </constraints> <format> Return the complete receiver as one code block, then a short note on configuring the webhook in repo settings and testing with a redelivery. </format>

You are a distributed-systems engineer who designs reliable ingestion endpoints. <context> I receive webhooks from a third party and need a resilient inbound endpoint delivered as one self-contained, ready-to-run file. It must accept fast, verify, dedupe, enqueue, and process with retries so a slow downstream never drops events. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS / PYTHON] - Provider and auth method: [E.G. SHARED SECRET HEADER, HMAC, BASIC AUTH] - Queue or store available: [E.G. REDIS, SQS, IN-MEMORY FALLBACK] - Downstream action: [WHAT PROCESSING EACH EVENT DOES] - Max retries and backoff: [E.G. 5 TRIES, EXPONENTIAL] </inputs> <task> Write the endpoint plus a worker: validate the auth header, dedupe on a provider event id, enqueue the raw payload, and return 202 immediately. Then a worker function pulls from the queue, processes with a try/catch, and on failure re-enqueues with exponential backoff up to the max, sending exhausted events to a dead-letter list. </task> <constraints> - Acknowledge within the endpoint; do real work in the worker. - Idempotent processing keyed on the event id. - Dead-letter path for permanently failing events; structured logs. - Comment the retry/backoff math; env vars for secrets. </constraints> <format> Return the endpoint and worker as one code block, then a short note on swapping the in-memory queue for a real broker. </format>

You are an e-commerce backend engineer who integrates Shopify stores. <context> I need a Shopify webhook endpoint as one self-contained, ready-to-run file that verifies Shopify's HMAC header and processes order events into my system. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS / PYTHON] - Topics to handle: [E.G. orders/create, orders/paid, orders/cancelled, refunds/create] - What to do per topic: [E.G. CREATE INTERNAL ORDER, TRIGGER FULFILLMENT, UPDATE INVENTORY] - Datastore: [WHERE ORDERS ARE STORED] - Secret source: [SHOPIFY_WEBHOOK_SECRET env var] </inputs> <task> Write the endpoint: read the raw body, verify the base64 HMAC in X-Shopify-Hmac-Sha256 with a constant-time compare, capture the shop domain and topic headers, dedupe on the order id, then route each topic to a named handler that maps the Shopify order to your internal shape with a documented TODO. Return 200 on success and on unknown topics. </task> <constraints> - Verify HMAC on the raw body before parsing; reject bad signatures with 401. - Idempotent on order id; safe to receive the same webhook twice. - Include a clean field-mapping function from Shopify order to internal order. - Comment the mapping; secrets from env only. </constraints> <format> Return the complete endpoint as one code block, then a short note on registering webhooks via the Shopify Admin API and testing. </format>

You are an integration engineer who builds event routers between systems. <context> I receive one inbound webhook and need to fan it out to several downstream targets, transformed per target. Deliver a self-contained, ready-to-run relay service that routes by rules and retries per destination. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS / PYTHON] - Inbound source and auth: [PROVIDER + HEADER/HMAC] - Downstream targets: [E.G. SLACK WEBHOOK, INTERNAL API, CRM ENDPOINT] - Routing rules: [WHICH EVENTS GO WHERE, ANY FILTERS] - Per-target transform: [HOW EACH PAYLOAD SHOULD LOOK] </inputs> <task> Write the relay: verify the inbound request, evaluate a declarative routing table (event type or field match -> list of targets), transform the payload for each matched target with a named mapper, and POST to each with independent per-target retry and timeout. Aggregate delivery results and return a summary. Failing one target must not block the others. </task> <constraints> - Declarative routing config at the top so I can add targets without touching logic. - Per-target isolation: independent retries, timeouts, and error capture. - Structured delivery log per target (status, attempts). - Comment the routing table format; secrets from env. </constraints> <format> Return the relay service as one code block, then a short note on adding a new downstream target in the config. </format>

You are a backend engineer who implements OAuth 2.0 flows securely. <context> I need to connect users' Google accounts with the authorization-code flow, delivered as one self-contained, ready-to-run module: the login redirect, the callback exchange, and token refresh. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS / PYTHON FLASK] - Scopes needed: [E.G. gmail.readonly, calendar.events] - Redirect URI: [YOUR CALLBACK URL] - Token storage: [E.G. POSTGRES, ENCRYPTED AT REST] - Credential source: [GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET env vars] </inputs> <task> Write three endpoints/functions: a start route that builds the consent URL with state, scopes, access_type=offline and prompt=consent; a callback route that validates state, exchanges the code for tokens, and persists them per user; and a getValidAccessToken helper that transparently refreshes an expired access token using the refresh token and updates storage. </task> <constraints> - Generate and verify a CSRF state parameter on the callback. - Store refresh tokens encrypted; never log tokens. - Auto-refresh with a small expiry safety margin. - Comment the flow steps; credentials from env only. </constraints> <format> Return the complete module as one code block, then a short note on the Google Cloud console setup (consent screen, redirect URI, scopes). </format>

You are a Slack platform engineer who ships installable apps. <context> I'm building a Slack app that teams install into their workspace. Deliver a self-contained, ready-to-run OAuth install flow that stores each workspace's bot token so I can post as the app later. </context> <inputs> - Runtime and framework: [E.G. NODE + EXPRESS] - Bot scopes: [E.G. chat:write, channels:read, commands] - Redirect URL: [YOUR CALLBACK URL] - Storage: [WHERE PER-WORKSPACE TOKENS LIVE] - Credentials: [SLACK_CLIENT_ID / SLACK_CLIENT_SECRET / SLACK_STATE_SECRET env vars] </inputs> <task> Write the install route that redirects to Slack's OAuth v2 authorize URL with scopes and a signed state, and the callback route that verifies state, calls oauth.v2.access to exchange the code, and persists the returned team id, bot user id, and bot access token. Add a helper that fetches the stored token for a given team id for later API calls. </task> <constraints> - Signed, expiring state to prevent CSRF. - Store one token record per workspace (team id as key). - Handle the OAuth error querystring gracefully with a friendly page. - Comment the exchange; secrets from env only. </constraints> <format> Return the complete flow as one code block, then a short note on the Slack app config (redirect URL, scopes, Add to Slack button). </format>

You are a security-focused engineer who implements OAuth for public clients. <context> I have a single-page or mobile app with no secure backend secret, so I need the authorization-code flow with PKCE. Deliver a self-contained, ready-to-run client module. </context> <inputs> - Client platform: [E.G. REACT SPA / REACT NATIVE] - Identity provider and endpoints: [AUTHORIZE + TOKEN URLS] - Client id and redirect URI: [VALUES] - Scopes: [WHAT ACCESS IS NEEDED] </inputs> <task> Write the client flow: generate a cryptographically random code_verifier and its S256 code_challenge, build the authorize URL with the challenge and a state value, handle the redirect back by validating state and exchanging the code plus verifier at the token endpoint (no client secret), then store tokens securely and expose a refresh function. Include the base64url and SHA-256 helpers. </task> <constraints> - PKCE with S256; never embed a client secret in the client. - Store the verifier and state only until the callback completes. - Use secure storage appropriate to the platform; note the tradeoffs. - Comment the PKCE steps clearly. </constraints> <format> Return the complete client module as one code block, then a short note on why PKCE replaces the implicit flow and where tokens should live. </format>

You are a backend engineer who owns third-party credential storage. <context> I connect many users to several OAuth providers and need one reusable, self-contained token service that stores tokens encrypted and always hands back a valid access token, refreshing when needed. </context> <inputs> - Runtime and framework: [E.G. NODE / PYTHON] - Providers and their token endpoints: [LIST WITH REFRESH URLS] - Encryption key source: [E.G. TOKEN_ENC_KEY env var, KMS] - Datastore: [WHERE TOKEN RECORDS LIVE] </inputs> <task> Write a TokenStore with: saveTokens(userId, provider, tokens) that encrypts access and refresh tokens before persisting with an expiry timestamp; getValidAccessToken(userId, provider) that decrypts, checks expiry with a safety margin, refreshes via the provider's token endpoint if stale, re-persists, and returns the fresh access token; and a provider registry so adding a provider is config, not new code. </task> <constraints> - Authenticated symmetric encryption (e.g. AES-256-GCM) at rest; never log plaintext tokens. - Single refresh path guarded against concurrent double-refresh. - Provider registry keyed by name so new providers are declarative. - Comment the crypto and refresh logic; key from env/KMS only. </constraints> <format> Return the complete service as one code block, then a short note on rotating the encryption key without locking users out. </format>

You are a solutions architect who designs OAuth integrations for enterprise CRMs. <context> Before I write code, I need a precise, self-contained integration spec for connecting to a CRM via OAuth that a developer can implement without guessing. </context> <inputs> - CRM: [HUBSPOT / SALESFORCE / OTHER] - What my app needs to do: [E.G. READ CONTACTS, CREATE DEALS] - App type: [WEB APP WITH BACKEND / PUBLIC APP / MARKETPLACE LISTING] - Multi-tenant?: [ONE ACCOUNT / MANY CUSTOMER ACCOUNTS] - Data residency or compliance notes: [ANY CONSTRAINTS] </inputs> <task> Produce the spec as a structured document: required scopes with justification; the exact authorize and token endpoints; the redirect and install flow step by step; token storage and refresh strategy for multi-tenant; the specific API calls for each capability with method, path, and key fields; rate-limit and pagination handling; error and reconnect handling when a token is revoked; and a testing checklist. </task> <constraints> - Cite the real endpoints, scope names, and rate limits for the named CRM. - Cover multi-tenant token isolation explicitly. - Be implementation-ready: no vague "handle errors" without saying how. - Use tables where they make the spec clearer. </constraints> <format> Return the spec as a structured document with headed sections and tables, then a short note on the riskiest part to prototype first. </format>

You are a data engineer who builds reliable sync jobs. <context> I need a scheduled one-way sync that mirrors an Airtable table into a Postgres table, delivered as one self-contained, ready-to-run script. </context> <inputs> - Airtable base id, table name, and fields: [VALUES] - Target Postgres table and columns: [SCHEMA] - Field-to-column mapping: [WHICH AIRTABLE FIELD -> WHICH COLUMN] - Unique key for upsert: [E.G. AIRTABLE RECORD ID] - Runtime: [E.G. NODE / PYTHON] </inputs> <task> Write the script: page through all Airtable records via the API, map each record to a Postgres row, and upsert on the unique key so re-runs are safe. Detect and soft-delete rows whose Airtable record no longer exists. Wrap writes in a transaction, log a summary of inserted/updated/deleted counts, and exit non-zero on failure so a scheduler can alert. </task> <constraints> - Idempotent upserts; safe to run repeatedly. - Handle Airtable pagination and rate limits with backoff. - Transactional writes; clear counts in the log. - Comment the mapping; API keys and DB URL from env only. </constraints> <format> Return the complete script as one code block, then a short note on scheduling it (cron/GitHub Actions) and handling schema drift. </format>

You are a data engineer who builds extract-transform-load pipelines. <context> I need to pull data from a REST API, clean it, and load it into a warehouse table, delivered as one self-contained, ready-to-run Python script. </context> <inputs> - Source API endpoint and auth: [URL + AUTH METHOD] - Pagination style: [OFFSET / CURSOR / PAGE NUMBER] - Fields to keep and their target types: [LIST] - Warehouse target: [E.G. BIGQUERY, SNOWFLAKE, POSTGRES] and table - Transform rules: [CLEANING, DEDUPE, DERIVED FIELDS] </inputs> <task> Write the pipeline in three clear stages: extract (page through the API with retries and rate-limit backoff), transform (normalize types, apply cleaning and derived-field rules, drop duplicates), and load (batch upsert into the warehouse table with a run timestamp). Add a main function, structured logging per stage, and a row-count reconciliation at the end. </task> <constraints> - Separate extract/transform/load functions; each testable in isolation. - Retries with backoff on the source; batched loads to the warehouse. - Type-safe transforms with explicit null handling. - Comment each stage; all credentials from env. </constraints> <format> Return the complete pipeline as one code block, then a short note on scheduling and making the load incremental later. </format>

You are a data engineer who designs efficient incremental syncs. <context> My dataset is too large to full-sync every run. I need an incremental sync that only pulls records changed since the last run, delivered as one self-contained, ready-to-run script. </context> <inputs> - Source and how it exposes change: [E.G. updated_at FIELD / CHANGE CURSOR / WEBHOOK CATCH-UP] - Target store: [WHERE DATA LANDS] - Where to persist the watermark: [E.G. A STATE TABLE OR FILE] - Unique key for upsert: [FIELD] - Runtime: [NODE / PYTHON] </inputs> <task> Write the script: read the last saved watermark (default to a safe backfill start on first run), query the source for records changed after it (with a small overlap window to avoid boundary gaps), upsert them into the target by unique key, then advance and persist the watermark only after a successful load. Handle the first-run backfill and log the window and row counts. </task> <constraints> - Advance the watermark only on confirmed success (no data loss on crash). - Overlap window plus idempotent upsert to tolerate clock skew. - Explicit first-run backfill behavior. - Comment the watermark logic; credentials from env. </constraints> <format> Return the complete script as one code block, then a short note on picking the overlap window and recovering from a bad watermark. </format>

You are a systems engineer who builds bidirectional data sync. <context> Two systems both let users edit the same records and I need them kept in sync both ways. Deliver a self-contained, ready-to-run sync engine with an explicit conflict-resolution policy. </context> <inputs> - System A and B, and the shared entity: [E.G. CONTACTS BETWEEN CRM AND APP] - Fields to sync and direction rules: [WHICH FIELDS, WHICH WIN] - Change detection per side: [TIMESTAMPS / VERSION / WEBHOOK] - Conflict policy: [LAST-WRITE-WINS / SYSTEM-A-WINS / FIELD-LEVEL MERGE] - Mapping store for cross-ids: [WHERE A-ID <-> B-ID LIVES] </inputs> <task> Write the engine: maintain an id-mapping table linking records across systems, pull changes from both sides since the last run, and reconcile. For each changed record, if only one side changed, propagate; if both changed, apply the chosen conflict policy (with field-level merge where specified) and log the resolution. Prevent echo loops by tracking sync origin, and upsert missing records so new items flow both ways. </task> <constraints> - Explicit id-mapping to avoid duplicate creation. - Echo-loop prevention so a synced write doesn't re-trigger a sync. - Deterministic, logged conflict resolution per record. - Comment the reconciliation; credentials from env. </constraints> <format> Return the complete engine as one code block, then a short note on why loop prevention matters and how to audit conflicts. </format>

You are an automation engineer who bridges spreadsheets and databases. <context> A team edits data in a Google Sheet and I need it reliably synced into a database table, delivered as one self-contained, ready-to-run script. </context> <inputs> - Sheet id, tab name, and header row: [VALUES] - Column-to-field mapping and types: [MAPPING] - Target table and unique key: [SCHEMA + KEY] - Auth method: [SERVICE ACCOUNT / OAUTH] - Runtime: [NODE / PYTHON] </inputs> <task> Write the script: read the sheet range via the Sheets API, treat the header row as the schema, validate and coerce each row's types, skip or report invalid rows without aborting the whole run, and upsert valid rows into the database by the unique key. Report a summary of synced, skipped, and invalid rows, and optionally write a status column back to the sheet. </task> <constraints> - Robust type coercion and per-row validation (bad rows don't kill the run). - Idempotent upsert on the unique key. - Handle empty cells and trailing blank rows. - Comment the validation; credentials from env or a service-account file path. </constraints> <format> Return the complete script as one code block, then a short note on granting the service account access and scheduling the sync. </format>