Communication from Mattermost to Parabol needs to be authenticated. Possibly the simples way is to have a shared key and sign the messages. For signing I will try a RFC9421 library and as algorithm use HMAC-SHA256 because we consider it secure enough for our JWT.

Two way communication can be established with the message signing above.
For notifications, Parabol will send a REST request to the mattermost plugin. Therefore we must know the address of the plugin. There are 2 possible solutions to this:

1. We globally configure the address of mattermost. This means one mattermost instance is tightly coupled with one Parabol instance. When we start a meeting, we always send a notification to the Plugin and the Plugin itself checks if a channel is configured to receive the notification. Alternatively we could add an additional table where we store which teams should receive notifications, but then we're close to solution 2)
2. We add a new IntegrationProvider type. This will be associated with an organization (global would be possible too) and a mattermost instance. In this case every time a channel is configured to receive notifications, the plugin contacts Parabol and adds an additional Integration'Auth entry for the team. This has the advantage to fit into the current notification architecture.

I will try to go with 2) and a global provider which is configured in postdeploy based on env.