SINCH HUB MESSAGEMEDIA with ZOHO DESK

SINCH HUB MESSAGEMEDIA with ZOHO DESK

1) what I need from MessageMedia,
2) what I want to confirm on the Zoho Desk Dev Forum.

MessageMedia – needs and requirements
Goal: Send SMS from a Zoho Desk widget for EU users.
Auth: HTTP Basic (API Key + Secret). Keys must not live in the browser.
API endpoints:
Delivery/callbacks: a webhook we’ll expose (HTTPS).
Payload format:
JSON; E.164 numbers; UTF‑8 text; optional delivery_report true.
CORS/Connectivity:
Preferred: allow our origin (https://.zappsusercontent.eu) to call your API directly (CORS allowlist).
If not supported: we’ll use a server‑side proxy (Zoho Catalyst/Function) that calls MessageMedia server‑to‑server.
Webhooks:
We will host a public HTTPS callback; please document expected headers, retry policy, and signature/validation if available.
Throughput/limits:
Provide EU region throughput and rate‑limit guidance; error codes and recommended backoff.
Compliance:
Any sender ID/Alphanumeric restrictions for PL/EU; content/opt‑out requirements.
Example request we plan to send (server‑to‑server if CORS not possible):
Headers: Authorization: Basic <base64(key:secret)>, Content-Type: application/json
Body:
{
"messages": [{
"content": "Hello",
"destination_number": "+48123456789",
"delivery_report": true
}]
}
Zoho Desk Dev Forum – what I want to confirm
Context: Widget runs at desk.ticket.detail.rightpanel. Direct browser calls to MessageMedia fail with CORS.
Question 1: Is the recommended pattern for third‑party SMS always a server‑side proxy (e.g., Zoho Catalyst/Function) called from the widget?
Question 2: Is there any supported, documented way for a widget to call third‑party APIs directly (CORS allowlisting via Desk), or is proxy truly the only production‑safe option?
Question 3: For using Desk REST (e.g., /api/v1/contacts/{id}) from a widget, what is the correct, supported approach to:
attach orgId,
leverage Internal OAuth connections,
and call via ZOHODESK.request/invoke? A minimal working example would help.
Goal: Validate that server‑side proxy is the final/best practice (security + CORS), and get a confirmed example for Desk REST usage from a widget.