OVERVIEW
We designed and built a secure, custom middleware integration (PHP, OAuth 2.0) connecting two independent business systems that have no native way to exchange data – a client facing platform and a third-party system holding the authoritative source records. The integration authenticates automatically, pulls changed records on a fixed schedule, and keeps both systems in sync with zero manual re-entry.
THE PROBLEM (before)
– The two systems could not talk to each other out of the box – one platform had no visibility into records that only ever got updated in the other system.
– Without a bridge, staff would have had to manually check the source system and copy the relevant details across by hand – slow, error-prone, and out of date as soon as it was typed in.
– No shared reference existed to reliably match a record on one side to the correct record on the other, so duplicate or conflicting entries were a real risk.
THE SOLUTION (what we built)
1. Secure server-side integration layer
Built a dedicated authentication and connection layer (OAuth 2.0 client-credentials) that talks to the third-party system’s API entirely server-side. No credentials or tokens are ever exposed to end users, and the two systems never require a person to manually reconcile them.
2. Scheduled automatic sync engine
A background job polls the source system on a fixed interval (every 5 minutes), pulling only records that are new or changed since the last successful run – a near-real-time model, not a batch job someone has to remember to trigger, and not a process that waits days for someone to collate paper.
3. Record matching & upsert logic (no duplicates, no data loss)
Every incoming record is matched against existing local data using a unique reference ID from the source system. Matched records are updated in place, new records are created, and anything no longer present upstream is automatically flagged – the same underlying pattern as tracking whether an item was used, unused, or substituted, applied to whichever state field the source system exposes.
4. Full audit trail and fail-safe error handling
Every sync run is logged with a timestamp and a count of records added, updated, and closed, giving full visibility into what changed and when. Failures (timeouts, rate limits, source system downtime) are caught and logged, and the sync simply retries on the next cycle – existing data is never deleted or corrupted, and a temporary outage on either side never surfaces as an error to end users.
5. Admin visibility & manual override
An admin screen shows live sync status, the last successful run, and a rolling sync log, plus a “Sync Now” control to force an immediate update on demand – the same operational visibility a stock or operations team needs to trust the numbers without opening a spreadsheet.
HOW IT WORKS, STEP BY STEP
1. The integration authenticates with the source system’s API using stored, admin-only credentials – no manual login step, ever.
2. On a fixed schedule, the sync engine requests only the records changed since the last run.
3. Each record is checked against a unique reference ID already stored locally: existing records are updated, new ones are created, removed/closed ones are flagged.
4. The outcome of every run – added, updated, closed counts, and any errors – is written to a visible, timestamped log.
5. The client-facing platform always reads from its own local, synced copy of the data, so it stays fast and available even if the source system is briefly unreachable.
6. An admin can trigger an immediate sync on demand instead of waiting for the next scheduled cycle.
WHY IT MATTERS
The value isn’t the sync job itself – it’s replacing manual, error-prone copying between two disconnected systems with an automated, validated, near-real-time bridge that keeps both sides consistent without anyone re-typing anything. The same architecture – a secure server-side integration layer, scheduled sync, upsert-by-reference-ID matching, fail-safe error handling that never loses existing data, and a visible admin/audit log – applies directly to any scenario where a front-line entry system needs to feed a central accounting or stock system that has no native integration path of its own.
RESULTS
– Delivered a complete, working integration layer – authentication, scheduled sync, record matching, and error handling – built and functioning against the live third-party API; final field verification and client sign-off remain the only steps before go-live.
– Manual cross-referencing between two disconnected systems replaced with an automated, auditable sync running every 5 minutes instead of a hand-reconciled process.
– Modular, hook-based architecture lets the sync logic, schedule, and destination fields be extended or reconfigured without rebuilding the integration – supporting a phased rollout (pilot first, then wider deployment) rather than an all-at-once switch.
TECH STACK
PHP 8, OAuth 2.0 client-credentials authentication, scheduled cron-based sync engine, custom data model with reference-ID deduplication, structured audit logging.
