Service Communication¶

How the projects call each other and the external services they orchestrate. Only the connections between components are covered here; each repo documents its own internal calls.

Communication matrix¶

From	To	Mechanism	Purpose
Website	Platform	Service Binding `API_WORKER` → `swapps-worker`	Blog, leads, support, chat (Worker→Worker, no public HTTP)
Website	App	`fetch` to `SUBSCRIPTIONS_API_URL` (`https://app.swapps.com`)	Subscription plans and checkout sessions
Website	AI	`fetch` to `/api/ai/*`	Project recommendations and AI description refinement
Platform	WordPress	`fetch` to the WP REST API (`https://swapps.com/wp-json/wp/v2`)	Fetch posts/authors/tags for the blog
App	External	SDK / REST	Stripe, ClickUp, Toggl, Pipedrive, QuickBooks, FrontApp, AGNO, S3, Mailgun, OneSignal
External	App	Inbound webhooks (`POST`, server-to-server)	ClickUp, Stripe and Zapier → `app.swapps.com`; require a WAF Skip exception (see Cloudflare Edge)
Platform	External	REST	Pipedrive (CRM), Mailgun (email), V0 (prototypes), LiteLLM, Agno, ClickUp

Important integration notes¶

The Website never calls WordPress directly: blog content flows Website → Platform → WP REST API.
The Platform worker is not a reverse-proxy for the other services; it is the site's API backend (leads, AI prototypes, support) and an integrations orchestrator.
App and Platform share some external integrations (Pipedrive, ClickUp, Mailgun) but do not call each other directly.

Service Binding (Website → Platform)¶

The Website reaches the Platform worker through a Cloudflare Service Binding (API_WORKER). This is a Worker→Worker call that never leaves Cloudflare's network — no public HTTP hop, lower latency, and no need to expose the Platform worker publicly for this path.

sequenceDiagram participant U as User (browser) participant W as Website (swapps-client) participant P as Platform (swapps-worker) participant WP as WordPress (WP REST API) U->>W: GET /blog/some-post W->>P: Service Binding API_WORKER (get post) P->>WP: fetch /wp-json/wp/v2/posts?slug=... WP-->>P: post JSON (+ WPML translations) P-->>W: normalized post W-->>U: SSR HTML

Inbound webhooks (External → App)¶

ClickUp, Stripe and Zapier deliver events to app.swapps.com over POST. Because this is server-to-server traffic, each route needs a Cloudflare WAF Skip exception (Super Bot Fight Mode) — see Cloudflare Edge. The skip only removes the bot challenge; each endpoint still validates its own signature/token (ClickUp X-Signature, Stripe STRIPE_WEBHOOK_SECRET, Zapier token).

Adding a new inbound integration

A new provider webhook (or any new server-to-server consumer of the App's API) must be added to the corresponding WAF Skip rule, or it fails with a silent 403 the app never sees.