Slack, Jira, Asana OAuth and signed outbound webhooks

Integrations can connect Slack, Jira, or Asana with OAuth, and still POST signed JSON when the agent stores activity or a timesheet is submitted, approved, or rejected. Tokens stay encrypted. Each organization only sees its own connections. The tray icon does not change.

Read /features/integrations, then the signed-in integrations tutorial. Ask VisibleHours “open zapier”, “webhook integrations”, “connect Slack”, or “add a webhook” opens Integrations. “Zapier tutorial” or “how to add a webhook” opens the signed-in tutorial with sample Catch Hook recipes. Public site search stays on /features/integrations and will not create a hook, email your team, or run outreach.

Connect a workspace

1. Sign in and open Integrations.
2. Press Connect on Slack, Jira, or Asana. Finish consent. The card shows Connected.
3. Access tokens stay encrypted. They are never shown on the page.
4. Disconnect removes the encrypted tokens.

If client IDs are missing, Connect stays disabled — VisibleHours will not invent a workspace. This slice stores a token. It does not post to a channel, file an issue, or create a task.

Signed outbound webhooks

1. Keep Catch inbox on to inspect a payload here, or paste an HTTPS Catch Hook URL.
2. Choose events. Save (create). Copy the signing secret once.
3. Press Send test ping. The ping includes type: "ping" and headers X-VisibleHours-Signature and X-VisibleHours-Timestamp. Inbox rows stay on the delivery log. HTTPS rows show the status from your endpoint.
4. Verify: HMAC-SHA256 of timestamp + "." + rawBody, hex digest, prefixed v1=.

The connected-workspace summary is a VisibleHours reading of your rows, not a live model. VisibleHours does not email employees from Integrations. Site search and Ask VisibleHours will not draft outreach or run a workflow.

What this is not

• Not a hidden listener. Employees still see the tray and can pause.
• Not a live write-back into Slack, Jira, or Asana in this slice.
• Not a dump of another organization’s people or hours.
• Not an email campaign. Paste a Catch Hook if you need an automation inbox.