One place for every
service connection.
The Credentials app is where all third-party service connections live — API keys, OAuth tokens, email accounts, SMTP relays, webhooks. Encrypted at rest, testable on demand, and access-controlled so only the right automations and people can use each one.
The Problem It Solves
API keys scattered across config files and environment variables are a security liability.
Before this app, service credentials lived in environment variables, hardcoded in automation files, or shared in spreadsheets. Rotating a key meant hunting through code. Revoking access for a departed staff member meant hoping nothing got missed.
The Credentials app centralises everything. Automations and apps reference a credential by its ID. Rotate the key once in the app and every automation using it picks up the change immediately — no code edits, no redeploys.
Security
Sensitive values are encrypted. They never appear in plain text in the database.
What gets encrypted
Any field marked as sensitive in the credential type definition — API keys, passwords, client secrets, access tokens, refresh tokens — is encrypted before being written to the database. Non-sensitive metadata (service names, base URLs, email addresses) is stored in plain text for display.
Password fields
In the credential editor, sensitive fields display as password inputs with a show/hide toggle. Once saved, those values are write-only from the UI — you can overwrite them but not read them back out. This is intentional.
Never paste keys into chat
Add credentials through the app, not through a chat message. Chat logs are stored and indexed. Even if you trust the AI, credential values don't belong in a conversation history.
Connection Testing
Test any credential before you depend on it.
Every supported credential type has a test endpoint. After saving a credential, hit Test Connection and the platform makes a live call to the service using the stored credential. You get a pass or fail result in the modal — no guessing whether the key is valid.
For OAuth credentials (Xero, Google, Microsoft), the test also verifies that the token is still active and can be refreshed. Expired tokens show a reconnect prompt.
When to test
After initial setup, after rotating a key, and any time an automation starts failing with authentication errors.
OAuth reconnect
For OAuth types, the Connect button in the editor starts the OAuth flow. After authorising with the provider, you're redirected back and the token is saved automatically.
Access Control
Control who can use each credential.
Per-credential user access
Each credential has an access list. Only users on that list can view and use the credential in automations or app configurations. Users not on the list can't see the credential exists.
Active / inactive toggle
Disable a credential without deleting it. Any automation trying to use an inactive credential will fail cleanly rather than run with no authentication. Useful for temporarily revoking access or quarantining a suspected compromised key.
“Use for” tagging
Tag a credential with its intended purpose (e.g. “Campaign sending”, “Accounting sync”) so automations and apps can discover the right credential without hardcoding an ID.
Available Connectors
Every service the platform connects to today.
Connectors are grouped by category. OAuth types require a one-time authorisation flow with the provider. API key types just need the key. Everything else is explained in the setup form when you add one.
Any email account that supports IMAP and SMTP — Gmail (with app password), Outlook, cPanel hosting, custom mail servers. Supports SSL/TLS. Used by automations that send or receive email from a real mailbox.
Used for: Read inboxes, send transactional emails from a staff email address.
Microsoft 365 services via OAuth2 — Outlook mail, OneDrive, SharePoint. Requires an Azure AD App Registration. Used where staff use Outlook as their primary email.
Used for: Email sync, calendar access, OneDrive file operations.
Brevo's authenticated SMTP relay. Delivers bulk and transactional email with better deliverability than a raw mail server. Used by the campaign send engine and notification emails.
Used for: All outbound campaign emails and automated notification emails.
Email Validation
Email address validation and verification API. Checks whether an address is valid, a catch-all, disposable, or likely to bounce before you send to it.
Used for: Pre-send validation in the Campaigns app to protect sender reputation.
Brevo's REST API (distinct from SMTP). Used for list management, contact syncing, and programmatic campaign control beyond what SMTP covers.
Used for: Contact list sync, bounce and unsubscribe webhooks from Brevo back to the platform.
AI & Machine Learning
OpenAI API for GPT-4o text generation, Whisper speech-to-text transcription, DALL-E image generation, and text embeddings (used by the vector search in tasks and customer state).
Used for: AI-generated email digests, task summaries, meeting transcription, semantic search.
Finance & Accounting
Xero accounting platform via OAuth2. Access invoices, contacts, accounts, payments, and reports. Token refreshes automatically.
Used for: P&L dashboards, invoice generation, financial reporting panels.
One credential covers the full Google workspace — Gmail, Drive, Calendar, and Google Cloud Platform. Scopes are chosen at setup so you only grant the access you actually need.
Used for: Gmail inbox reading, calendar sync, Drive file access.
Dedicated connector for Google Analytics 4 and Search Console data. Pulls traffic, conversion, keyword, and impression data into Dashboard panels.
Used for: Website analytics panels in the Dashboard app.
Notifications
A Telegram bot token. Automations use this to push messages to a Telegram chat or channel — typically for error alerts, critical automation failures, or operational notifications that shouldn't wait for an email digest.
Used for: Automation error alerts, log-level notifications from the Log Viewer.
File Processing
CloudConvert API for file format conversion — documents, images, audio, video. Used when automations need to convert uploaded files before processing or storage.
Used for: Document conversion in automation pipelines.
Search & SEO
Bulk SERP data API — keyword rankings, SERP features, competitor analysis, and search volume data at scale. More cost-effective than SerpAPI for high-volume lookups.
Used for: SEO dashboards, keyword rank tracking automations.
Real-time Google search results API. Returns structured SERP data including organic results, featured snippets, People Also Ask, and local pack data.
Used for: Real-time search result lookups, competitor monitoring.
CRM & Marketing
HubSpot private app API key. Used during the HubSpot-to-Supabase data migration to pull contacts, companies, deals, lists, campaigns, and associations via the HubSpot v3 REST API.
Used for: CRM sync automation (data migration). Read-only after HubSpot is decommissioned.
Ontraport CRM and marketing automation API. Used where Ontraport is the source of truth for contacts, campaigns, and automations.
Used for: Contact sync from Ontraport into the platform database.
Monday.com project management platform via OAuth2. Access boards, items, updates, and columns programmatically.
Used for: Project tracking integrations, board-to-task sync.
Time Tracking
Clockify time tracking API. Access reports, workspaces, projects, and time entries. Used for billing-related automations and timesheet dashboards.
Used for: Timesheet reporting, billable hours automation.
Learning Management
Moodle LMS REST API. Access courses, users, enrolments, grades, and activity completions. The Moodle sync automation uses this to pull student engagement data into Supabase for dashboards.
Used for: Student engagement sync, Moodle Dashboard, cohort risk monitoring.
E-Commerce
Amazon Selling Partner API for seller account data — orders, inventory, reports, and fulfilment. Requires an AWS IAM role and Amazon developer account registration.
Used for: Amazon seller dashboards, order sync, inventory monitoring.
Storman facility management software API. Used for storage unit operators to pull occupancy, customer, and financial data into reporting dashboards.
Used for: Facility occupancy and revenue reporting.
Generic / Extensible
For any service that authenticates with a simple API key. Configure the header name, header prefix (Bearer, Token, etc.), or switch to query parameter auth. Covers the majority of third-party services that don't have a dedicated connector.
Used for: Any API that doesn't have a dedicated type yet.
A webhook endpoint with optional token authentication. Point automations at an n8n workflow, a Zapier catch, or any HTTP endpoint that accepts a POST payload.
Used for: Bridging to legacy n8n workflows, external automation triggers.
A fully configurable OAuth2 credential for any provider that isn't covered by a dedicated type. You supply the authorisation URL, token URL, client ID, secret, and scopes manually.
Used for: Any OAuth2-compatible service without a built-in connector.
Direct database credentials — host, port, username, password, database name — for MySQL, PostgreSQL, or other SQL databases. Used where automations need to query a client's own database directly.
Used for: Legacy system integrations, external database queries.
A Supabase project URL and service role key for a secondary Supabase instance (not the platform's own database). Allows automations to read from or write to an external Supabase project.
Used for: Cross-project data sync, client-owned Supabase instances.
Extensibility
Need a connector that isn't here? It can be added.
Each connector type is defined in a single configuration file (credentialTypes.js).
Adding a new type is a Vibe Coding task — describe the service, its fields (which are sensitive,
which are metadata), and whether it uses OAuth. The new type appears in the credential picker
immediately after the change is merged.
If the service has a test endpoint, a test handler can be added to the API at the same time so the Test Connection button works for it immediately.
The Generic API Key type covers most cases
If a service just needs an API key in a header or query parameter, use the Generic API Key type. A dedicated type only adds value when there's a specific OAuth flow, scope picker, or test endpoint worth building.