Integrations
Connect a store penv can move values into or out of, then map an environment to it.
Integrations covers the stores penv holds a credential for. Connect a Platform is the other direction, where something outside proves who it is to penv. Nothing appears under both.
The group holds three rows: Connections, Dynamic Engines and Providers.
The store directory
Providers lists the stores penv can mirror values into or read them out of. Eighty-four entries across forty-six vendors, covering cloud secret stores as well as hosting platforms and CI variable stores.
Each card carries the vendor and what the connection reads or writes. It also says when a written value reaches the running app, which matters more than it sounds.
| Activation | What it means |
|---|---|
immediate | The running app sees the new value at once |
on-next-deploy | It arrives with your next deploy |
on-request | It arrives the next time something asks for it |
restart-on-write | Writing restarts the workload |
Connecting is disabled once your plan's connection quota is used. Free allows 1 connection. Pro and Enterprise allow as many as you like.
Connecting one
/integrations/authorize/[provider] walks the connect. Pick a method and do what it asks, then test the result and finish the grant. The methods differ by vendor.
| Method | What you do |
|---|---|
quick-link | Follow a prepared link into the vendor's console |
consent-redirect | Sign in at the vendor and consent |
iac-snippet | Apply a rendered policy or template |
cli-snippet | Run a rendered command |
manual | Paste a credential you already have |
Testing inside the wizard checks the credential without storing it: nothing is inserted, nothing is cached, and nothing lands in the record. Verifying a connection that already exists is the audited one, because there is a stored credential whose state just changed.
The wizard offers to create the first mapping at the end.
One connection
/integrations/[connectionId] shows health and when it last verified, alongside the settings fixed at connect time and the list of mappings on it. From here you can:
- verify it again, or rotate the credential penv holds
- add a mapping
- stop the connection, or remove it
One mapping
A mapping moves keys in one direction for one environment.
| Direction | What it does |
|---|---|
import | Reads from the store into penv |
export | Writes from penv into the store |
What happens to a name that already exists is the conflict policy. An import can skip it, write a new version, or fail. An export can create only, overwrite, or overwrite and prune whatever penv does not know about.
overwrite_and_prune deletes names in the store that penv has no key for. Read the preview before you apply that one.
Preview is a dry run reading names alone. Apply runs the plan you just read. An export mapping shows a notice about values leaving penv, and asks you to acknowledge it.
What each action needs
| Action | Needs | Confirm it is you | Recorded as |
|---|---|---|---|
| Open Connections or Providers | integration:read | No | not recorded |
| Render a policy for a method | integration:read | No | not recorded |
| Connect a store | integration:connect | No | integration.connected |
| Test a credential before it is stored | integration:connect | No | not recorded |
| Verify a stored connection | integration:connect | No | integration.verified |
| Rotate the stored credential | integration:connect | No | integration.credential_rotated |
| Add a mapping | integration:configure | No | integration.sync_created |
| Remove a mapping | integration:configure | No | integration.sync_removed |
| Preview a run | integration:run | No | integration.run_enqueued |
| Apply a run | integration:run | No | integration.run_applied |
| Stop a connection | integration:delete | No | integration.revoked |
| Remove a connection | integration:delete | No | integration.connection_removed |
None of these asks you to confirm it is you.
Next: values that mint on demand.