Procore Install & Auth

Overview

Set up Procore SDK/CLI and configure authentication credentials.

Prerequisites

• Node.js 18+ or Python 3.10+
• Package manager (npm, pnpm, or pip)
• Procore account with API access
• API key from Procore dashboard

Instructions

Step 1: Install SDK

# Node.js
npm install @procore/sdk

# Python
pip install procore

Step 2: Configure Authentication

# Set environment variable
export PROCORE_API_KEY="your-api-key"

# Or create .env file
echo 'PROCORE_API_KEY=your-api-key' >> .env

Step 3: Verify Connection

// Test connection code here

Output

• Installed SDK package in node_modules or site-packages
• Environment variable or .env file with API key
• Successful connection verification output

Error Handling

Examples

TypeScript Setup

import { ProcoreClient } from '@procore/sdk';

const client = new ProcoreClient({
  apiKey: process.env.PROCORE_API_KEY,
});

Python Setup

from procore import ProcoreClient

client = ProcoreClient(
    api_key=os.environ.get('PROCORE_API_KEY')
)

Resources

• Procore Documentation
• Procore Dashboard
• Procore Status

Next Steps

After successful auth, proceed to procore-hello-world for your first API call.

Procore Multi-Environment Setup

Overview

Configure Procore across development, staging, and production environments.

Prerequisites

• Separate Procore accounts or API keys per environment
• Secret management solution (Vault, AWS Secrets Manager, etc.)
• CI/CD pipeline with environment variables
• Environment detection in application

Environment Strategy

Configuration Structure

config/
├── procore/
│   ├── base.json           # Shared config
│   ├── development.json    # Dev overrides
│   ├── staging.json        # Staging overrides
│   └── production.json     # Prod overrides

base.json

{
  "timeout": 30000,
  "retries": 3,
  "cache": {
    "enabled": true,
    "ttlSeconds": 60
  }
}

development.json

{
  "apiKey": "${PROCORE_API_KEY}",
  "baseUrl": "https://api-sandbox.procore.com",
  "debug": true,
  "cache": {
    "enabled": false
  }
}

staging.json

{
  "apiKey": "${PROCORE_API_KEY_STAGING}",
  "baseUrl": "https://api-staging.procore.com",
  "debug": false
}

production.json

{
  "apiKey": "${PROCORE_API_KEY_PROD}",
  "baseUrl": "https://api.procore.com",
  "debug": false,
  "retries": 5
}

Environment Detection

// src/procore/config.ts
import baseConfig from '../../config/procore/base.json';

type Environment = 'development' | 'staging' | 'production';

function detectEnvironment(): Environment {
  const env = process.env.NODE_ENV || 'development';
  const validEnvs: Environment[] = ['development', 'staging', 'production'];
  return validEnvs.includes(env as Environment)
    ? (env as Environment)
    : 'development';
}

export function getProcoreConfig() {
  const env = detectEnvironment();
  const envConfig = require(`../../config/procore/${env}.json`);

  return {
    ...baseConfig,
    ...envConfig,
    environment: env,
  };
}

Secret Management by Environment

Local Development

# .env.local (git-ignored)
PROCORE_API_KEY=sk_tes

Procore Observability

Overview

Set up comprehensive observability for Procore integrations.

Prerequisites

• Prometheus or compatible metrics backend
• OpenTelemetry SDK installed
• Grafana or similar dashboarding tool
• AlertManager configured

Metrics Collection

Key Metrics

Prometheus Metrics

import { Registry, Counter, Histogram, Gauge } from 'prom-client';

const registry = new Registry();

const requestCounter = new Counter({
  name: 'procore_requests_total',
  help: 'Total Procore API requests',
  labelNames: ['method', 'status'],
  registers: [registry],
});

const requestDuration = new Histogram({
  name: 'procore_request_duration_seconds',
  help: 'Procore request duration',
  labelNames: ['method'],
  buckets: [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5],
  registers: [registry],
});

const errorCounter = new Counter({
  name: 'procore_errors_total',
  help: 'Procore errors by type',
  labelNames: ['error_type'],
  registers: [registry],
});

Instrumented Client

async function instrumentedRequest<T>(
  method: string,
  operation: () => Promise<T>
): Promise<T> {
  const timer = requestDuration.startTimer({ method });

  try {
    const result = await operation();
    requestCounter.inc({ method, status: 'success' });
    return result;
  } catch (error: any) {
    requestCounter.inc({ method, status: 'error' });
    errorCounter.inc({ error_type: error.code || 'unknown' });
    throw error;
  } finally {
    timer();
  }
}

Distributed Tracing

OpenTelemetry Setup

import { trace, SpanStatusCode } from '@opentelemetry/api';

const tracer = trace.getTracer('procore-client');

async function tracedProcoreCall<T>(
  operationName: string,
  operation: () => Promise<T>
): Promise<T> {
  return tracer.startActiveSpan(`procore.${operationName}`, async (span) => {
    try {
      const result = await operation();
      span.setStatus({ code: SpanStatusCode.OK });
      return result;
    } catch (error: any) {
      span.setStatus({ code: SpanStatusCode.ERROR, message: error.message });
     

Procore Performance Tuning

Overview

Optimize Procore API performance with caching, batching, and connection pooling.

Prerequisites

• Procore SDK installed
• Understanding of async patterns
• Redis or in-memory cache available (optional)
• Performance monitoring in place

Latency Benchmarks

Caching Strategy

Response Caching

import { LRUCache } from 'lru-cache';

const cache = new LRUCache<string, any>({
  max: 1000,
  ttl: 60000, // 1 minute
  updateAgeOnGet: true,
});

async function cachedProcoreRequest<T>(
  key: string,
  fetcher: () => Promise<T>,
  ttl?: number
): Promise<T> {
  const cached = cache.get(key);
  if (cached) return cached as T;

  const result = await fetcher();
  cache.set(key, result, { ttl });
  return result;
}

Redis Caching (Distributed)

import Redis from 'ioredis';

const redis = new Redis(process.env.REDIS_URL);

async function cachedWithRedis<T>(
  key: string,
  fetcher: () => Promise<T>,
  ttlSeconds = 60
): Promise<T> {
  const cached = await redis.get(key);
  if (cached) return JSON.parse(cached);

  const result = await fetcher();
  await redis.setex(key, ttlSeconds, JSON.stringify(result));
  return result;
}

Request Batching

import DataLoader from 'dataloader';

const procoreLoader = new DataLoader<string, any>(
  async (ids) => {
    // Batch fetch from Procore
    const results = await procoreClient.batchGet(ids);
    return ids.map(id => results.find(r => r.id === id) || null);
  },
  {
    maxBatchSize: 100,
    batchScheduleFn: callback => setTimeout(callback, 10),
  }
);

// Usage - automatically batched
const [item1, item2, item3] = await Promise.all([
  procoreLoader.load('id-1'),
  procoreLoader.load('id-2'),
  procoreLoader.load('id-3'),
]);

Connection Optimization

import { Agent } from 'https';

// Keep-alive connection pooling
const agent = new Agent({
  keepAlive: true,
  maxSockets: 10,
  maxFreeSockets: 5,
  timeout: 30000,
});

const client = new ProcoreClient({
  apiKey: process.env.PROCORE_API_KEY!,
  httpAgent: agent,
});

Pagination Optimization

async function* paginatedProcoreList<T>(
  fetcher: (cursor?: string) => Promise<{ data: T[]; nextCursor?: string }>
): AsyncGenerator<T

Procore Production Checklist

Overview

Complete checklist for deploying Procore integrations to production.

Prerequisites

• Staging environment tested and verified
• Production API keys available
• Deployment pipeline configured
• Monitoring and alerting ready

Instructions

Step 1: Pre-Deployment Configuration

• [ ] Production API keys in secure vault
• [ ] Environment variables set in deployment platform
• [ ] API key scopes are minimal (least privilege)
• [ ] Webhook endpoints configured with HTTPS
• [ ] Webhook secrets stored securely

Step 2: Code Quality Verification

• [ ] All tests passing (npm test)
• [ ] No hardcoded credentials
• [ ] Error handling covers all Procore error types
• [ ] Rate limiting/backoff implemented
• [ ] Logging is production-appropriate

Step 3: Infrastructure Setup

• [ ] Health check endpoint includes Procore connectivity
• [ ] Monitoring/alerting configured
• [ ] Circuit breaker pattern implemented
• [ ] Graceful degradation configured

Step 4: Documentation Requirements

• [ ] Incident runbook created
• [ ] Key rotation procedure documented
• [ ] Rollback procedure documented
• [ ] On-call escalation path defined

Step 5: Deploy with Gradual Rollout

# Pre-flight checks
curl -f https://staging.example.com/health
curl -s https://status.procore.com

# Gradual rollout - start with canary (10%)
kubectl apply -f k8s/production.yaml
kubectl set image deployment/procore-integration app=image:new --record
kubectl rollout pause deployment/procore-integration

# Monitor canary traffic for 10 minutes
sleep 600
# Check error rates and latency before continuing

# If healthy, continue rollout to 50%
kubectl rollout resume deployment/procore-integration
kubectl rollout pause deployment/procore-integration
sleep 300

# Complete rollout to 100%
kubectl rollout resume deployment/procore-integration
kubectl rollout status deployment/procore-integration

Output

• Deployed Procore integration
• Health checks passing
• Monitoring active
• Rollback procedure documented

Error Handling

Examples

Health Check Implementation

async function healthCheck(): Promise<{ status: string; procore: any }> {
  cons

Procore Rate Limits

Overview

Handle Procore rate limits gracefully with exponential backoff and idempotency.

Prerequisites

• Procore SDK installed
• Understanding of async/await patterns
• Access to rate limit headers

Instructions

Step 1: Understand Rate Limit Tiers

Step 2: Implement Exponential Backoff with Jitter

async function withExponentialBackoff<T>(
  operation: () => Promise<T>,
  config = { maxRetries: 5, baseDelayMs: 1000, maxDelayMs: 32000, jitterMs: 500 }
): Promise<T> {
  for (let attempt = 0; attempt <= config.maxRetries; attempt++) {
    try {
      return await operation();
    } catch (error: any) {
      if (attempt === config.maxRetries) throw error;
      const status = error.status || error.response?.status;
      if (status !== 429 && (status < 500 || status >= 600)) throw error;

      // Exponential delay with jitter to prevent thundering herd
      const exponentialDelay = config.baseDelayMs * Math.pow(2, attempt);
      const jitter = Math.random() * config.jitterMs;
      const delay = Math.min(exponentialDelay + jitter, config.maxDelayMs);

      console.log(`Rate limited. Retrying in ${delay.toFixed(0)}ms...`);
      await new Promise(r => setTimeout(r, delay));
    }
  }
  throw new Error('Unreachable');
}

Step 3: Add Idempotency Keys

import { v4 as uuidv4 } from 'uuid';
import crypto from 'crypto';

// Generate deterministic key from operation params (for safe retries)
function generateIdempotencyKey(operation: string, params: Record<string, any>): string {
  const data = JSON.stringify({ operation, params });
  return crypto.createHash('sha256').update(data).digest('hex');
}

async function idempotentRequest<T>(
  client: ProcoreClient,
  params: Record<string, any>,
  idempotencyKey?: string  // Pass existing key for retries
): Promise<T> {
  // Use provided key (for retries) or generate deterministic key from params
  const key = idempotencyKey || generateIdempotencyKey(params.method || 'POST', params);
  return client.request({
    ...params,
    headers: { 'Idempotency-Key': key, ...params.headers },
  });
}

Output

• Reliable API calls with automatic retry
• Idempotent requests preventing duplicates
• Rate limit headers properly handled

Error Handling

my-procore-project/
├── src/
│   ├── procore/
│   │   ├── client.ts           # Singleton client wrapper
│   │   ├── config.ts           # Environment configuration
│   │   ├── types.ts            # TypeScript types
│   │   ├── errors.ts           # Custom error classes
│   │   └── handlers/
│   │       ├── webhooks.ts     # Webhook handlers
│   │       └── events.ts       # Event processing
│   ├── services/
│   │   └── procore/
│   │       ├── index.ts        # Service facade
│   │       ├── sync.ts         # Data synchronization
│   │       └── cache.ts        # Caching layer
│   ├── api/
│   │   └── procore/
│   │       └── webhook.ts      # Webhook endpoint
│   └── jobs/
│       └── procore/
│           └── sync.ts         # Background sync job
├── tests/
│   ├── unit/
│   │   └── procore/
│   └── integration/
│       └── procore/
├── config/
│   ├── procore.development.json
│   ├── procore.staging.json
│   └── procore.production.json
└── docs/
    └── procore/
        ├── SETUP.md
        └── RUNBOOK.md

┌─────────────────────────────────────────┐
│             API Layer                    │
│   (Controllers, Routes, Webhooks)        │
├─────────────────────────────────────────┤
│           Service Layer                  │
│  (Business Logic, Orchestration)         │
├─────────────────────────────────────────┤
│          Procore Layer        │
│   (Client, Types, Error Handling)        │
├─────────────────────────────────────────┤
│         Infrastructure Layer             │
│    (Cache, Queue, Monitoring)            │
└─────────────────────────────────────────┘

// src/procore/client.ts
export class ProcoreService {
  private client: ProcoreClient;
  private cache: Cache;
  private monitor: Monitor;

  constructor(config: ProcoreConfig) {
    this.client = new ProcoreClient(config);
    this.cache = new Cache(config.cacheOptions);
    this.monitor = new Monitor('procore');
  }

  async get(id: string): Promise<Resource> {
    return this.cache.getOrFetch(id, () =>
      this.monitor.track('get', () => this.client.get(id))
    );
  }
}

// src/procore/errors.ts
export class ProcoreServiceError extends Error {
  constructor(
    message: string,
    public readonly code: string,
    public readonly retryable: boolean,
    public readonly originalError?: Error
  ) {
    super(message);
    this.name = 'ProcoreServiceError';
  }

// src/procore/client.ts
import { ProcoreClient } from '@procore/sdk';

let instance: ProcoreClient | null = null;

export function getProcoreClient(): ProcoreClient {
  if (!instance) {
    instance = new ProcoreClient({
      apiKey: process.env.PROCORE_API_KEY!,
      // Additional options
    });
  }
  return instance;
}

import { ProcoreError } from '@procore/sdk';

async function safeProcoreCall<T>(
  operation: () => Promise<T>
): Promise<{ data: T | null; error: Error | null }> {
  try {
    const data = await operation();
    return { data, error: null };
  } catch (err) {
    if (err instanceof ProcoreError) {
      console.error({
        code: err.code,
        message: err.message,
      });
    }
    return { data: null, error: err as Error };
  }
}

async function withRetry<T>(
  operation: () => Promise<T>,
  maxRetries = 3,
  backoffMs = 1000
): Promise<T> {
  for (let attempt = 1; attempt <= maxRetries; attempt++) {
    try {
      return await operation();
    } catch (err) {
      if (attempt === maxRetries) throw err;
      const delay = backoffMs * Math.pow(2, attempt - 1);
      await new Promise(r => setTimeout(r, delay));
    }
  }
  throw new Error('Unreachable');
}

const clients = new Map<string, ProcoreClient>();

export function getClientForTenant(tenantId: string): ProcoreClient {
  if (!clients.has(tenantId)) {
    const apiKey = getTenantApiKey(tenantId);
    clients.set(tenantId, new ProcoreClient({ apiKey }));
  }
  return clients

# .env (NEVER commit to git)
PROCORE_API_KEY=sk_live_***
PROCORE_SECRET=***

# .gitignore
.env
.env.local
.env.*.local

# 1. Generate new key in Procore dashboard
# 2. Update environment variable
export PROCORE_API_KEY="new_key_here"

# 3. Verify new key works
curl -H "Authorization: Bearer ${PROCORE_API_KEY}" \
  https://api.procore.com/health

# 4. Revoke old key in dashboard

const clients = {
  reader: new ProcoreClient({
    apiKey: process.env.PROCORE_READ_KEY,
  }),
  writer: new ProcoreClient({
    apiKey: process.env.PROCORE_WRITE_KEY,
  }),
};

import crypto from 'crypto';

function verifyWebhookSignature(
  payload: string, signature: string, secret: string
): boolean {
  const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}

interface AuditEntry {
  timestamp: Date;
  action: string;
  userId: string;
  resource: string;
  result: 'success' | 'failure';
  metadata?: Re

npm list @procore/sdk
npm view @procore/sdk version

open https://github.com/procore/sdk/releases

git checkout -b upgrade/procore-sdk-vX.Y.Z
npm install @procore/sdk@latest
npm test

// Before (v1.x)
import { Client } from '@procore/sdk';

// After (v2.x)
import { ProcoreClient } from '@procore/sdk';

// Before (v1.x)
const client = new Client({ key: 'xxx' });

// After (v2.x)
const client = new ProcoreClient({
  apiKey: 'xxx',
});

npm install @procore/sdk@1.x.x --save-exact

// Monitor for deprecation warnings in development
if (process.env.NODE_ENV === 'development') {
  process.on('warning', (warning) => {
    if (warning.name === 'DeprecationWarning') {
      console.warn('[Procore]', warning.message);
      // Log to tracking system for proactive updates
    }
  });
}

// Common deprecation patterns to watch for:
// - Renamed methods: client.oldMethod() -> client.newMethod()
// - Changed parameters: { key: 'x' } -> { apiKey: 'x' }
// - Removed features: Check release notes before upgrading

import express from 'express';
import crypto from 'crypto';

const app = express();

// IMPORTANT: Raw body needed for signature verification
app.post('/webhooks/procore',
  express.raw({ type: 'application/json' }),
  async (req, res) => {
    const signature = req.headers['x-procore-signature'] as string;
    const timestamp = req.headers['x-procore-timestamp'] as string;

    if (!verifyProcoreSignature(req.body, signature, timestamp)) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const event = JSON.parse(req.body.toString());
    await handleProcoreEvent(event);

    res.status(200).json({ received: true });
  }
);

function verifyProcoreSignature(
  payload: Buffer,
  signature: string,
  timestamp: string
): boolean {
  const secret = process.env.PROCORE_WEBHOOK_SECRET!;

  // Reject old timestamps (replay attack protection)
  const timestampAge = Date.now() - parseInt(timestamp) * 1000;
  if (timestampAge > 300000) { // 5 minutes
    console.error('Webhook timestamp too old');
    return false;
  }

  // Compute expected signature
  const signedPayload = `${timestamp}.${payload.toString()}`;
  const expectedSignature = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex');

  // Timing-safe comparison
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

type ProcoreEventType = 'resource.created' | 'resource.updated' | 'resource.deleted';

interface ProcoreEvent {
  id: string;
  type: ProcoreEventType;
  data: Record<string, any>;
  created: string;
}

const eventHandlers: Record<ProcoreEventType, (data: any) => Promise<void>> = {
  'resource.created': async (data) => { /* handle */ },
  'resource.updated': async (data) => { /* handle */ },
  'resource.deleted': async (data) => { /* handle */ }
};

async function handleProcoreEvent(event: ProcoreEvent): Promise<void> {
  const handler = eventHandlers[event.type];

  if (!handler) {
    console.log(`Unhandled event type: ${event.type}`);
    return;
  }

  try {
    await handler(event.data);
    console.log(`Processed ${event.type}: ${event.id}`);
  } catch (error) {
    console.error(`Failed to proc