Add keyword-based Instagram DM verification with ManyChat

[aceyeom]

Summary

Refactors Instagram DM handle verification to use a keyword trigger instead of a default reply, making the system more robust and explicit. Users now DM a keyword + code (e.g., seal 4071) to trigger verification, rather than relying on a catch-all default reply.

Key Changes

Documentation & Setup

• docs/SETUP-IG-VERIFY.md: Completely restructured to clarify the keyword-based flow:

  • Renamed §3 to emphasize "DB and keys" wiring
  • Split §3.2 into separate steps for secret generation and function deployment
  • Rewrote §4 to explain Keyword trigger (not Default Reply) with detailed ManyChat configuration
  • Added new §5 environment variable VITE_IG_KEYWORD (defaults to seal)
  • Expanded troubleshooting with keyword-specific issues
  • Added detailed explanation of the three-place keyword sync requirement

• docs/GO-LIVE.md: Updated references to keyword-based flow and added fail-closed safety explanation

• app/README.md: Clarified that seal fails closed on deployed builds without verification enabled

Frontend Changes

• app/src/api/igverify.js:

  • Added igKeyword() function to read VITE_IG_KEYWORD (defaults to seal)
  • Added igMessage(code) function to construct the full DM text (e.g., seal 4071)
  • Updated deep-link and message handling to use the keyword

• app/src/components/screens.jsx:

  • Updated IgVerifySheet to copy the full message (seal 4071) instead of just the code
  • Updated UI text to reflect "send this exact message" instead of "your code"

• app/src/App.jsx:

  • Added fail-closed safety check: if Supabase backend is connected but VITE_IG_VERIFY_ENABLED is not set, sealing is blocked with an operator notice
  • Prevents silent fallthrough to stub verification in production

• app/.env.example: Added VITE_IG_KEYWORD with documentation

• app/src/i18n/strings.js:

  • Updated verification UI strings to reference "message" instead of "code"
  • Added new error message for misconfigured verification

Backend Functions

• supabase/functions/celestual-manychat/index.ts:

  • Added KEYWORD constant (reads IG_KEYWORD secret, defaults to seal)
  • Enhanced codeCandidates() to prioritize codes immediately after the keyword (e.g., seal 4071) before falling back to any standalone 4-digit number
  • Added reEscape() helper for safe regex construction
  • Updated comments to explain keyword-based parsing

• supabase/functions/celestual-ig-webhook/index.ts:

  • Added KEYWORD constant (reads IG_KEYWORD secret, defaults to seal)
  • Enhanced codeCandidates() with same keyword-aware parsing logic
  • Added reEscape() helper

Notable Implementation Details

• Keyword sync requirement: The keyword must match in three places:

  1. ManyChat Keyword trigger (§4.1)
  2. Front-end VITE_IG_KEYWORD environment variable (§5)
  3. Function IG_KEYWORD secret (optional, only if overriding default)

• Fail-closed safety: On deployed builds with a real Supabase backend, sealing now blocks with an operator notice if verification isn't enabled, preventing accidental production deployments that silently stub users through.

• Code parsing priority: Both functions now try to extract codes from the keyword pattern first (seal 4071), then fall back to any standalone 4-digit number, ensuring robust parsing while maintaining security (parsing is never the security boundary).

• ManyChat trigger type: Uses Contains match

https://claude.ai/code/session_01QXRnr1V7MZMTMqUnUQdXcK

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
celestual	Ready	Preview, Comment	Jun 22, 2026 3:10pm