gabrielmoreira Flexport Deploy Integration
Overview
Deploy Flexport-powered applications to production. Webhook receivers need always-on hosting. Dashboards can use serverless. Background sync workers suit containers.
Prerequisites
- A deployment owner, approved logistics-data destinations, scoped secret-manager references, and tested rollback path.
- A staging environment with fictional shipments and a policy that excludes commercial documents from logs and health checks.
Output
Record the release/image identifier, environment, integration owner, approved destinations, canary result, aggregate health metrics, and rollback outcome. Do not include credentials, bills of lading, addresses, invoices, or shipment payloads.
Error Handling
- Stop promotion on signature, permission, destination, or idempotency failures.
- Pause workers and rotate scoped credentials when an exposure is suspected.
- Preserve only redacted incident evidence and use the rollback path before replaying events.
Examples
Deploy a staging receiver with a fictional shipment event, verify the signature and opaque event ID, then simulate an upstream failure. The service must return a generic health result, avoid logging the payload, and roll back the canary before production sync is enabled.
Instructions
Option A: Vercel (Dashboard + Webhook Routes)
// app/api/webhooks/flexport/route.ts (Next.js App Router)
import crypto from 'crypto';
export async function POST(req: Request) {
const body = await req.text();
const sig = req.headers.get('x-hub-signature') || '';
const expected = 'sha256=' + crypto.createHmac('sha256', process.env.FLEXPORT_WEBHOOK_SECRET!)
.update(body).digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
return new Response('Invalid signature', { status: 401 });
}
const event = JSON.parse(body);
// Process milestone, booking, invoice events
return new Response('OK');
}
Option B: Fly.io (Always-On Webhook Receiver)
# fly.toml
app = "flexport-webhooks"
primary_region = "iad"
[http_service]
internal_port = 3000
force_https = true
min_machines_running = 1
fly secrets set FLEXPORT_API_KEY="key" FLEXPORT_WEBHOOK_SECRET="secret"
fly deploy
Option C: Cloud Run (Shipment Sync Worker)
gcloud run deploy flexport-sync \
--source . --region us-central1 \
--set-secrets "FLEXPORT_API_KEY=flexport-key:latest" \
--min-instances 1 --timeout 300
Post-Deploy Verification
curl -X POST https://your-app.fly.dev/webhooks/flexport \
-H "X-Hub-Signature: sha256=invalid" -d '{"type":"test"}'
# Expected: 401 (signature verification working)
Resources
Next Steps
For webhook event handling, see flexport-webhooks-events.