Connect
Connect is where your third-party credentials live. You connect an outside account — GitHub, a social channel, a stock-media provider — once per workspace at connect.destesi.io, and from then on any product that needs that credential fetches it from Connect at the moment it runs.
The model: connect once, fetch at call time
Section titled “The model: connect once, fetch at call time”This is the rule that matters, and it is worth stating plainly:
Third-party credentials are stored once, in Connect, per workspace. They are never stored inside individual products. When a product needs to act on your behalf — clone a private repo, publish a video, search stock photos — it asks Connect for the credential at that moment.
This has real benefits for you:
- Connect a service once. Authorize GitHub a single time and every product in the workspace that works with GitHub can use it.
- Rotate or revoke in one place. Disconnect an account in Connect and every product instantly loses access — there are no stale copies scattered across products to hunt down.
- No secrets pasted into products. Products never hold your tokens; they borrow them per request.
What you can connect
Section titled “What you can connect”Connect groups more than fifty providers into ten categories: dev tools (GitHub, GitLab, Slack, Linear, Jira, Notion and more), social channels used to publish, advertising accounts, communication (Gmail, WhatsApp Business, Discord), CRM, storage, stock media, AI providers, commerce (payments and shipping), and cloud.
Each provider connects in the way that fits it: most use a one-click OAuth authorization flow, some take an API key you paste in once, AWS uses a role in your own account rather than keys, and WhatsApp Business uses its own signup flow.
More than a vault
Section titled “More than a vault”Connect started as a credential store, and that is still the foundation — but two capabilities are built on top of it, and they are the reason Connect is a product rather than a settings page:
- Actions. A catalog of typed operations you can run against a connected account — create an issue, send a message, publish a post — where you supply only arguments and the credential is injected server-side. The destination is fixed by the action, so there is no argument that can point the call somewhere else.
- Triggers. The inbound direction: a provider’s webhook, verified on arrival, then forwarded to an endpoint you control with a signature you can check.
Both are covered in Connect’s own docs. Your AI agents get the same action catalog through MCP.
Connection health
Section titled “Connection health”A connection has a status so you always know whether it still works. An active connection is ready to use; if a provider later rejects the credential — an OAuth grant expired, or an API key was revoked on the provider’s side — Connect marks it accordingly so you can reconnect. You can re-validate a connection at any time to confirm it is still good.
How products use it
Section titled “How products use it”When a product needs to act against a connected service, it requests the credential for that workspace and provider from Connect, then makes the call. Preview and Code Review detect GitHub through Connect to read your repositories; Deploy takes every cloud credential from it; Commerce reaches WhatsApp, your ad account, your carrier, and your payment provider through it; Studio publishes finished video to your connected social accounts; Chat acts on your connected services mid-conversation and can walk you through connecting one it needs.
You do not wire any of this up per product. You connect the account in Connect, and the products that need it find it there.