Integrations
The services an installation can be pointed at, what each one unlocks, and what happens when one is missing.
An installation works with nothing connected: it starts, signs somebody in with a password, and answers with canned words. Everything below is an addition. The rule everywhere in this product is the same, and it is worth stating once: a service that is not configured says so, instead of offering a control that fails.
Models
One gateway key reaches all of these. It is the connection that changes the product most, and the only one a buyer usually sets on the first day.
Anthropic
OpenAI
Google
xAI
DeepSeek
Mistral
Moonshot
Perplexity
Alibaba
Kling AI| Name | What it is for | Names |
|---|---|---|
| Vercel AI Gateway | Text, reasoning, search and pictures, through one key | AI_GATEWAY_API_KEY |
| Anthropic, OpenAI, Google | Direct routes, for an installation that would rather not use a gateway | ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_GENERATIVE_AI_API_KEY |
| Perplexity, Exa | Searching the web inside a turn | PERPLEXITY_API_KEY, EXA_API_KEY |
Model keys covers where the keys go and which of them do anything today.
People, and how they get in
| Service | What it unlocks | Names | Page |
|---|---|---|---|
| A Google button on the sign-in screen | GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | Google sign in | |
| GitHub | A GitHub button on the sign-in screen | GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET | GitHub sign in |
| GitHub, again | Letting a user save their project into their own repository | GITHUB_CONNECT_CLIENT_ID, GITHUB_CONNECT_CLIENT_SECRET | The connect application |
Two GitHub applications sounds like a mistake and is not: one gets a person through the door, the other writes to their repositories, and keeping them apart means a sign-in application that cannot touch anybody's code.
Mail, because two flows need it
| Service | What it unlocks | Names | Page |
|---|---|---|---|
| Resend | Confirmation codes, password resets, support replies | RESEND_API_KEY, EMAIL_FROM | Email that arrives |
Without it, sign in by password still works for accounts that are already confirmed, and nothing that needs a code does.
Where a project can be put
| Service | What it unlocks | Where it is configured |
|---|---|---|
| GitHub | A project saved into a repository the user owns | Customize, Connectors |
| Vercel | Deploying a project to an address | Platform → Deployments |
| Supabase | A managed database for a project that needs one | Platform → Databases |
| MCP servers | Extra tools, brought by a server that speaks the protocol | Customize, Connectors |
These are the integrations the installation offers. Which of them exist at all is the panel's decision, in
Platform → Integrations: a card whose application has not been registered is disabled with the reason beside
it, and Platform → Deployments and Platform → Databases hold the credentials and the ceilings.
Money
The marks this product ships for payment gateways are Stripe, Paddle, Razorpay, PayPal, Dodo Payments and
Flutterwave. Which of them a given installation can actually take money through is the list in
Money → Payments, and it depends on which keys that installation holds.
| Piece | What it decides |
|---|---|
| Gateways | Which providers are offered, and each one's keys |
| Mode | Test or live, per gateway |
| Tax | Whether prices include tax, and the rate |
| Coupons | Discounts, their limits and their expiry |
| Dunning | What happens when a payment fails, and how many times to try |
Until at least one gateway is configured, the pricing page says billing is not ready rather than offering a button that fails. Money is the panel page; Billing is what a user sees.
What all of these have in common
The token belongs to the person who connected it A user who connects
their own GitHub account is the only one who can use that token. The owner of the installation cannot read it, use it, or see it, and neither can anybody else's account.
Everything is sealed before it is stored Tokens and provider keys are
encrypted with SETTINGS_SECRET and written to the database as ciphertext.
A dump of the database is not a list of anybody's credentials.
A key is never shown back The panel reports whether a name is set, with
a four-character hint, and never the value. A key can be replaced or removed, and it cannot be read out. That is what makes the panel safe to open while somebody is looking over your shoulder.
Removing a connection removes the ability, not the data Disconnecting a
provider deletes the stored token. It does not delete the projects, the messages or the account that used it.
Rotating `SETTINGS_SECRET` unseals nothing
Every stored token becomes unreadable at the moment that value changes, because the key that opens them is gone. Rotate it deliberately, then reconnect the integrations and re-paste the provider keys. Anything you would rather not re-enter belongs in an environment variable instead.
When one of them is missing
| What you see | What it means |
|---|---|
| A social button says the provider is not configured | The pair for that provider is not set on the deployment |
| A connector card is disabled with a reason | Platform → Integrations has no application registered for it |
| The pricing page says billing is not ready | No payment gateway has keys yet |
System → Status & health shows the gateway red | No model key, or the gateway is refusing |
| Mail is not arriving though the key is set | The sending domain is not verified at the provider, or the codes are in a spam folder |