Skip to main content

REST vs Backend SDK

Both paths register Business Tools in the same workspace and execute through the same runtime. The difference is how Qefro reaches your organization backend.

At a glance

DimensionREST / OpenAPIBackend SDK
Best forExisting HTTPS APIsAuth, workflows, org logic in code
You implementHTTP endpoints (already exist)Handlers + optional Customer Provider
Qefro callsYour REST URLSigned webhook POST /qefro
DiscoveryManual / OpenAPI importtools.list + Sync Tools
Service authAPI_KEY, BEARER_TOKENSigning secret (HMAC)
End-user authEND_USER_IDENTITY (forward JWT/session)lookup + authorize() challenge/resume
Raw JWT to your codeYes (REST forward)No — identity attributes only
OTP / loginBuild your own HTTP OTP APINative challenge/resume
CRUD on vendor APIExcellentOverkill
Stateful multi-stepAwkwardNatural
PerformanceOne HTTP hopWebhook + your handler logic
StreamingLimited by HTTP responseHandler-controlled
Tool syncOpenAPI re-importRe-run Sync Tools
Secrets in QefroPer-tool encrypted secretPer-connection signing secret

Decision guide

Choose REST when

  • You have OpenAPI or Swagger for a stable API.
  • Operations are CRUD-like (GET /orders/{id}).
  • Third-party SaaS exposes API keys.
  • End-user authorization is your JWT validated on each request (END_USER_IDENTITY).

Choose SDK when

  • Customers must OTP, log in, or pass multi-step checks inside chat.
  • Business rules span multiple internal services.
  • You prefer handlers in TypeScript/Rust next to domain code.
  • You need lookup.required channel-aware identity before invoke.

Choose both when

Real products mix layers — see Mixed integrations.

Identity: the critical distinction

MechanismRESTSDK
Widget identify() JWTForwarded as Authorization: Bearer on HTTP callNot forwarded as secret
Email / phone on channelOptional X-Qefro-* headersidentity object on webhook
OTPYour REST API (if you build it)authorize() challenge → tool.resume

Details:

Security comparison

TopicRESTSDK
Credential storageEncrypted per toolEncrypted signing secret per connection
SSRFOutbound URL validationWebhook URL validation
Customer PII in logsRedact in your API responsesRedact in handler returns
Least privilegeScoped API keys per toolHandler-level permission checks

Migration paths

  1. REST first, SDK later — Start with read-only REST; move auth-heavy flows to SDK handlers.
  2. SDK first, REST for vendors — Core domain in SDK; wrap Stripe/Shippo as REST tools.
  3. OpenAPI trim — Import full spec, disable writes, add SDK for authenticated mutations.