Systems integration and API development for the software you already run

Payment providers and SaaS tools send webhooks with at-least-once delivery. The same event can arrive twice, and events can arrive in a different order from the one in which they happened. Integration code that assumes otherwise works in testing and fails in production.

We built this handling into a development agency's operations platform, where work flows from deal to client, project, time, invoice and Stripe settlement on Next.js, TypeScript, Supabase and PostgreSQL. Stripe webhooks report paid, failed, partially refunded and disputed states. Idempotency keys on every state change make duplicate events harmless, and a small state machine decides which status transitions are allowed, so repeated, late and out-of-order events all end on the true final state.

• Signature checks on every incoming webhook before anything is processed
• Stored event IDs, so a repeated event is recognised and skipped
• A fast acknowledgement, with the real work done in a background job
• Retries with back-off when a downstream system is unavailable
• Current state fetched from the source API when event order matters
• A daily reconciliation job that catches anything a webhook missed

Integration often means swapping out one system while the rest stay. An online school from a leading hairstyling-education brand, with 180,000+ learners in 50+ countries and 250+ video courses, had payments and course access that no longer kept up. Safock rebuilt those two parts on Next.js, TypeScript, PostgreSQL, GraphQL and Stripe and connected them to the WordPress site the content team already used.

Before the rebuild, the support inbox kept receiving the same requests: learners charged twice, learners who paid but could not watch, and course access granted by hand. Now Stripe runs the checkout and the right courses open for that learner, while editors keep publishing in WordPress as before.

ERPs hold the records a business cannot afford to corrupt, so we treat writes with care. Mavick, Safock's AI operating system for textile factories, reads ERP data live from SAP Business One, SAP S/4HANA, Odoo, Oracle NetSuite, Microsoft Dynamics 365, WFX Cloud ERP and Datatex NOW, and writes back only after a person approves the change. It also connects to Gmail, Outlook, Google Sheets, Slack and WhatsApp Business.

For ongoing data sync we agree, before writing code, which system owns each field, which way each field flows, and how conflicts resolve (last write wins, a merge, or a queue for a person to decide). Older ERPs without a modern API can often be reached through database views, scheduled file exports or a vendor middleware layer.

Single sign-on lets staff open every connected system with one company account from Google Workspace or Microsoft Entra ID, using SAML or OpenID Connect. When someone leaves, disabling one account closes access everywhere. We scope SSO alongside role mapping, so a person's job title decides what they can see in each system.

Security is part of the build from the first line. Secrets live in a secrets manager, API keys get the narrowest permissions possible, and integration logs avoid storing personal data they do not need. If you handle data in Saudi Arabia, we plan data residency and Saudi PDPL questions with you early.

A link between two systems with good APIs and test sandboxes is a small job. An ERP sync that needs data cleanup, conflict rules and approval steps is a larger one. You see scope, milestones and pricing in the proposal, and a fixed quote follows discovery.

• How many systems are involved, and which way data flows between them
• The quality of each API, and whether a sandbox exists to test against
• Data volume and how often records need to sync
• Mapping and cleanup needed before the first sync
• Approval steps on writes to an ERP or finance system