Integrations

Rasket on Vercel, Netlify and Cloudflare. There is no marketplace listing to install today; there are two routes that work on every one of them.

No marketplace listing, yet

A one-click Vercel Marketplace integration is deliberately deferred. A native listing is billed through the hosting provider — a second billing system beside the Stripe checkout and portal your plan already uses — and it needs a partner review that only a launched product can pass. Meanwhile, a connectable integration is just an OAuth client, which already works. So until the listing exists, pick one of the two routes below.

The two routes

An API key in the environment. For your own app, deployed to your own project. Create a key in the dashboard under API keys, store it as a secret environment variable, and send from server code.
An OAuth app. For a product that connects other people's Rasket teams — an integration you build and publish. Register it once through POST /oauth/register with a fixed redirect URI on your own host, and follow the OAuth flow. Each customer approves it for one team, and can revoke it from Connected apps.

Whichever route, the credential stays on the server. Never put a key or a token in a variable your framework exposes to the browser.

Vercel

1. Create the credential

An API key — ideally sending_access, restricted to the one domain this project sends from — or, for an integration, a registered OAuth client.

2. Add it to the project

In the project's settings, under environment variables, add RASKET_API_KEY as a sensitive variable for the environments that send. Redeploy: variables are read when a deployment is built.

3. Send from a route handler or server action

import { Rasket } from "rasket";

const rasket = new Rasket({
  apiKey: process.env.RASKET_API_KEY,
  userAgent: "acme-billing/1.0",
});

Use the Node.js runtime: the rasket package imports node:crypto for webhook verification. Set userAgent — a request with no User-Agent is refused.

Netlify

1. Create the credential

As for Vercel: a narrowly scoped API key, or a registered OAuth client.

2. Add it to the site

In the site's configuration, under environment variables, add RASKET_API_KEY and mark it secret. Scope it to Functions so it never reaches a build log or the client bundle, then trigger a new deploy.

3. Send from a function

In a Netlify Function, process.env.RASKET_API_KEY holds the key, and the client above works unchanged.

Cloudflare

1. Create the credential

As above: a narrowly scoped API key, or a registered OAuth client.

2. Store it as a Worker secret

npx wrangler secret put RASKET_API_KEY

On Pages, add it as an encrypted environment variable in the project's settings instead.

3. Send from the Worker

A Worker reads secrets from env, not process.env. Plain fetch is the simplest client there — send the User-Agent yourself:

export default {
  async fetch(request, env) {
    const response = await fetch("https://api.rasket.com/emails", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${env.RASKET_API_KEY}`,
        "User-Agent": "acme-billing/1.0",
        "Content-Type": "application/json",
      },
      body: JSON.stringify(message),
    });
    // …
  },
};

If you are building the integration

An OAuth app has no client secret to hide, but it does have a registration access token (rkor_…), shown once, that can change its redirect URIs or delete it — and deleting a client revokes it on every team that connected it. Keep that token in your own secret store, never in the integration's shipped code.

Ask for the fewest scopes the integration needs; a customer sees each one on the consent screen before approving.