Integrations

All integrations are managed from the dashboard at Settings -> Integrations. The page shows a catalogue of six integrations grouped into three categories: Issue Trackers (Jira, Linear, GitHub Issues), Communication (Slack, Discord) and Automation (Webhooks). Use the category filter buttons at the top to narrow the list.

Each integration is configured once per workspace and stored against the workspace owner's account (the roast_integrations table). An integration set up by an admin therefore applies to the whole workspace, not just the person who created it. When feedback arrives on any of the workspace's forms, Roast loads the owner's enabled integrations and dispatches to all of them.

A card shows "Connect" if the integration has never been set up. Once connected it shows a status badge - green "Connected" when enabled, or grey "Paused" when disabled - along with Pause/Enable, Configure and Disconnect controls.

Reading the integrations list is allowed for every role (owner, admin, editor, viewer). However, creating, editing, pausing/enabling and disconnecting integrations all require the integrations:write permission, which is held only by owners and admins.

Editors and viewers can see which integrations are connected but will receive a "Forbidden" (403) error if they attempt to connect, change, toggle or disconnect one. This is enforced server-side in every write route (POST, PATCH, DELETE), so the restriction cannot be bypassed from the browser.

The separate "create issue from this submission" action is gated differently: it is a moderation action requiring submissions:write, which owners, admins and editors hold but viewers do not.

Slack posts a richly formatted message to a channel whenever qualifying feedback arrives. It includes the form name, a quoted excerpt of the feedback, the type (praise/roast), heat level or star rating, who it was from, the page URL, any AI summary and AI tags, plus action buttons (View Feedback, Approve, Reject) and a video thumbnail when available.

Setup: in Slack, create an Incoming Webhook for the channel you want notifications in, then in Roast click Connect on the Slack card and paste the Webhook URL. You can optionally set a Default Channel (for example #feedback). The webhook URL must be a valid HTTPS hooks.slack.com URL - Roast rejects anything else.

Discord posts an embed to a channel via an incoming webhook when qualifying feedback arrives. It carries the same information as Slack (type, heat/rating, author and so on) formatted as a Discord embed.

Setup: in Discord, go to Server Settings -> Integrations and create a webhook for your channel, then click Connect on the Discord card in Roast and paste the Webhook URL. The URL must be a valid HTTPS discord.com or discordapp.com URL and must point at an /api/webhooks/... path.

When configuring Slack or Discord you set "Notify on" with three checkboxes: Praise, Roasts, and "Nuclear roasts only". By default Praise and Roasts are on and Nuclear is off.

The delivery logic is: if the feedback is praise and Praise is off, it is skipped; if it is a roast and Roasts is off, it is skipped; and if "Nuclear roasts only" is enabled, anything that is not a nuclear-heat roast is skipped. In other words, ticking "Nuclear roasts only" narrows delivery to nuclear roasts regardless of the other boxes.

The generic Webhook integration POSTs a JSON payload to any HTTPS URL you control when a submission is created. The payload has the shape { event, timestamp, data } where event is submission.created and data contains the submission id, type, content, heat level, rating, author name/email, page URL and form id.

Setup: click Connect on the Webhooks card, enter your endpoint URL and, optionally, a Signing Secret. If you provide a secret, Roast signs each request with HMAC-SHA256 and sends the signature so you can verify authenticity. Each delivery includes the headers X-Roast-Signature (the HMAC hex digest), X-Roast-Event (the event name) and X-Roast-Timestamp.

Issue trackers let Roast create an issue from feedback. Connecting a tracker requires its credentials: Jira needs Domain, Email, API Token and Default Project (project key); Linear needs an API Key and Team ID; GitHub Issues needs a Personal Access Token, Repository Owner and Repository Name. Help text on each field points to where to generate the token (id.atlassian.com for Jira, linear.app/settings/api for Linear, github.com/settings/tokens for GitHub).

Issues can be created two ways. Automatically: on submission creation, the dispatcher passes the submission to each connected tracker, which only creates an issue if that tracker's auto-create rules are met. Manually: a user can trigger creation from an individual submission via the dashboard's create-issue action, which forces creation in every connected tracker, bypassing the auto-create gating entirely.

Auto-create rules (stored per tracker in the autoCreate config) gate automatic creation by: enabled on/off; feedbackTypes (praise/roast); minHeatLevel (using the order lukewarm, warm, hot, fire, nuclear - feedback below the threshold is skipped); and requireTags (the feedback must carry at least one of the required AI tags). Note that the Configure modal does not currently expose fields for these auto-create rules, so automatic issue creation depends on autoCreate being present in the stored config; the reliable, user-facing path is the manual create-issue action.

On a connected card, Pause toggles the integration off without deleting its configuration (the card then shows "Paused" and it stops firing); Enable turns it back on. Configure re-opens the settings modal so you can change non-secret fields or rotate secrets. Disconnect deletes the integration entirely.

When editing, only the fields you change are sent. Masked secret placeholders are treated as "unchanged" and never overwrite the stored secret, so you can safely save a change to, say, a Slack channel without re-entering the webhook URL.