Integrations

Integrations let your app use another system — post a message in Slack, read an invoice in Stripe, add an event to a calendar. They are not how people sign in to your app (that is Sign in with Google and its relatives on the Authentication page): connecting Google Calendar does not let anyone sign in with Google, and signing in with Google does not let your app touch anyone’s calendar.

Connect once, use everywhere

Open Integrations under Services, pick a tool and choose Connect. There are two ways in:

• Sign in to the tool (OAuth). A window from the tool asks you to allow access; Sapilon never sees your password. Where the tool offers it you can pick which permissions to give.
• Paste a key. For tools that work with a key or token (Telegram, Stripe, WhatsApp Business, Airtable, Notion), each field says where to find it. Sapilon checks it with the tool before saving.

Either way the credential is stored encrypted and never shown again — not to you, not to the agent, not in the app’s code or settings.

Which environments

When you connect, choose where it applies: Build Server, Rehearsal, Live, or any mix. A common setup is a test Stripe key on Build and Rehearsal and the real one on Live — two connections of the same tool, each on its own environments. Two connections of one tool never cover the same environment. You can change the environments later without reconnecting.

What the app can do

The app does not talk to the tool directly. It asks Sapilon, which checks the request against a short list of what that integration allows, adds the credential, and passes the tool’s answer back. A request outside the list is refused, so a mistake in the app can’t, say, delete every Slack channel. Each integration’s page lists what it can do.

Messages and files that pass through are not stored by Sapilon; what is recorded is only that a call happened — which kind, when, how long it took and how big it was.

Whose account is connected

The app acts as the account that connected it. If that person leaves the company, their access ends and the app stops reaching the tool. For anything that should outlive one person, connect with a shared or service account — a Slack workspace admin, a company Stripe key, a dedicated Google account — rather than yours.

When a connection stops working

If the tool stops accepting the saved sign-in (it expired or someone revoked it), the connection turns Needs reconnecting, the person who connected it is notified, and the app’s calls answer with a clear message instead of failing silently. Choose Reconnect and sign in again.

Incoming events

Some tools can tell your app when something happens — a Slack mention, a paid invoice, a Telegram message. Sapilon receives these, checks they really came from the tool, and passes them to the app. For Slack and Telegram there is nothing to set up. For Stripe and WhatsApp Business, open the connection, choose Show events URL and add it in the tool’s dashboard; treat that URL like a password.

Disconnecting

Disconnect revokes the access at the tool where it supports that, deletes the stored credential and frees the environments. The app keeps running; its calls to that tool answer “not connected” until you connect it again.

The tools

Airtable, Dropbox, Google Calendar, Google Drive, Google Sheets, Notion, Slack, Stripe, Telegram and WhatsApp Business.

Google Calendar and Google Sheets are in beta while Sapilon’s Google verification completes: you may see an “unverified app” screen. Advanced → Bring your own OAuth app avoids it.

A tool that isn’t listed

For a system that is not on this page, keep its key on the Secrets page: the app reads it by name, and nobody can read the value back.