Integrations & Infrastructure FAQ

Answers to common questions about securing API keys, configuring the Telegram notification bot, and managing local browser caching.

What should I do if an API key is lost or exposed?

If an API key used on your public website is leaked:

1. Log into the Platform Console and go to Settings > Integrations.
2. Find the compromised key in your list.
3. Click Revoke Key to invalidate it immediately. (Any external widgets using this key will stop loading data).
4. Click Generate New Key.
5. Copy the new token and update your website widgets or plugins to restore functionality.

Are custom public API widgets rate-limited?

Yes. To protect your parish from denial-of-service attempts and spam:

• Rate-Limiting: The public API enforces a limit of 100 requests per minute from a single IP address.
• Form Safeguards: Submission forms (like event signups or contact forms) limit submissions to 5 per minute per IP.
• Throttling Notifications: If these limits are crossed, subsequent requests receive temporary throttle errors until the block period expires.

How do we pair the Telegram notification bot with our staff?

To receive real-time alerts on Telegram:

1. Members or clergy navigate to My Profile > Security & Integrations.
2. Click Connect Telegram Bot.
3. The system generates a personal, one-time authentication code (e.g., /auth 987654).
4. Click the link to open the church’s Telegram bot.
5. Send the authentication command to the bot. The bot will confirm that your Telegram handle is paired with your church profile.

How does the local browser cache manage storage capacity?

• Asset Precaching: The app shell (HTML pages, CSS layouts, and icon libraries) takes up minimal space (under 15MB) in your browser’s local cache.
• Storage Limits: Database rosters preloaded for offline attendance use browser storage (IndexedDB). The browser automatically clears old temporary check-in files once they are successfully synced to the server, ensuring the app never exhausts your device’s storage.