Connect

Connect is where your workspace’s external accounts live. Authorize a service — GitHub, Slack, WhatsApp, Meta Ads, Google Drive, an AI provider — once, and everything else follows from it:

• Every Destesi product fetches that credential at call time, so you never paste a token into more than one product.
• You can act on it directly, through a catalog of typed actions — create an issue, send a message, publish a post — with the credential injected server-side.
• You can listen to it, by pointing a provider’s webhooks at Connect and having deliveries forwarded to your own endpoint, signed.
• You can just ask. Connect’s home is an agent that manages all of the above in conversation.

Connect lives at connect.destesi.io.

Connect your first service

1. Open Connect and sign in. Your single sign-on session carries over from any other Destesi product — see Accounts & SSO.

2. Pick your workspace. Connections are workspace-scoped: everyone in the workspace shares them, and they never leak across workspaces.

3. Choose a provider from the catalog and click Connect. What happens next depends on how that provider authenticates — see below.

4. Done. The connection shows as ACTIVE, and any product in your workspace can use it.

How providers authenticate

Style	What you do	Examples
OAuth	Click through the provider’s consent screen and land back in Connect	GitHub, Slack, Linear, Notion, Jira, YouTube, Instagram, Facebook, LinkedIn, Gmail, Google Drive, Meta Ads, Stripe
API key	Paste a key. Connect validates it against the provider before saving — an invalid key is rejected on the spot and nothing is stored	OpenAI, Anthropic, ElevenLabs, Pexels, Unsplash, Cal.com, Wompi, Skydropx
Cloud role	Run a one-click CloudFormation stack in your own AWS account; Destesi assumes a scoped role instead of holding keys	AWS
Embedded signup	A provider-specific flow that provisions a business account as part of connecting	WhatsApp Business

The catalog spans more than 50 services across dev tools, social, advertising, communication, CRM, storage, stock media, AI, commerce, and cloud. Anything not currently available is shown with the reason rather than hidden.

Multiple accounts on one provider

Some providers expose several downstream accounts behind one login — a Google login can manage many YouTube channels; a Meta login can manage many Instagram business accounts. After the consent screen, Connect shows an account picker so you choose exactly which accounts to add, and you can flag one as the default. Accounts in the nav is where you change that later.

Run an action

A connection is permission. An action is what you do with it.

Connect ships a catalog of typed actions — over 200 of them, across roughly 40 providers — with a stable id of the form {provider}.{action}, such as github.create_issue or slack.post_message. Open Actions in Connect to browse the catalog, fill in the arguments, and run one against your connected account.

Each action declares whether it reads, writes, or is destructive, so you always know what you’re about to do before you confirm it.

# Run an action with a personal access token
curl -X POST https://api.connect.destesi.io/v1/actions/github.create_issue:execute \
  -H "Authorization: Bearer idn_pat_xxxxxxxx" \
  -H "X-Destesi-Workspace: your-workspace-slug" \
  -H "Content-Type: application/json" \
  -d '{"args":{"owner":"acme","repo":"web","title":"Hello from Connect"}}'

You supply only typed arguments. The destination host is fixed by the action definition and can never come from your input, and the credential is injected server-side — it appears in neither the request you write nor the result you get back. See Concepts for why that matters.

Note

The same actions are available to AI agents. The MCP server registers each one as a connect_{provider}_{action} tool, so an agent in Claude or Cursor can act on your connected accounts with your permissions.

Receive webhooks

A trigger turns a provider’s webhook into a signed, deduplicated delivery to an endpoint you control.

1. Create a subscription in Triggers, choosing the event type and the HTTPS endpoint to deliver to. Connect returns an ingest URL, an inbound secret, and a signing secret — shown exactly once.

2. Paste the ingest URL and inbound secret into the provider’s webhook settings. Connect verifies every incoming delivery against that secret.

3. Receive deliveries at your endpoint, each signed with X-Destesi-Signature so you can verify it came from Connect and hasn’t been replayed.

Deliveries are at-least-once — your endpoint must ignore a delivery_id it has already handled. Failures retry with backoff for several attempts before being marked failed, and the Deliveries drawer shows you what happened to each one.

Triggers currently support GitHub events. Connect does not register the webhook at the provider for you; you paste the URL yourself.

Manage it from chat

Signed in, Connect’s home page is an agent. Ask it what’s connected, what an action does, or to set up a trigger, and it does the work in conversation.

Two rules shape what it will do:

• It never shows a secret. Connected accounts, triggers, and results all come back redacted. Trigger secrets are revealed exactly once, by you, through the reveal action — never by the agent.
• Anything that changes something asks first. Read-only actions run directly; writes, and every trigger mutation, pause for your approval before they happen.

Use it from a product

Once a service is connected, you generally do nothing else — products pull the credential automatically:

• Preview and Code Review use your connected GitHub to fetch source and post results.
• Deploy takes every cloud provider credential from Connect.
• Commerce reaches WhatsApp, Meta Ads, your carrier, and your payment provider through it.
• Studio publishes finished videos to connected social accounts and pulls stock footage.
• Chat acts on your connected services inside a conversation, and can walk you through connecting one it needs.

Manage GitHub App installations

Where a product needs the Destesi GitHub App rather than an OAuth login — Preview and Code Review do — install it and bind it to your workspace under Workspace → GitHub in Connect.

Bringing a Destesi product to your own service?

If you build a server-side service that needs a workspace’s credential, fetch it through Connect’s controller API or one of the thin SDKs — never store the secret yourself.

TypeScript

import { ConnectClient, SlackClient } from "@destesi/connect";

const client = new ConnectClient({
  baseURL: "https://connect.destesi.io",
  controllerSecret: process.env.IDENTITY_CONTROLLER_SECRET!,
});

// Universal — works for any provider:
const cred = await client.fetchCredential("acme", "slack");

// Or a typed per-provider client:
const sl = await SlackClient.from(client, "acme");
await sl.postMessage("C0123", "hello from @destesi/connect");

Go

import connect "github.com/destesi/connect-go"

c := connect.New("https://connect.destesi.io", os.Getenv("IDENTITY_CONTROLLER_SECRET"))

// Universal:
cred, err := c.FetchCredential(ctx, "acme", "slack")

// Typed:
sl, err := c.Slack(ctx, "acme")
_, err = sl.PostMessage(ctx, "C0123", "hello from connect-go")

These SDKs are service-to-service only — never embed the controller secret in a browser bundle. Route browser credential fetches through your own backend.

Next steps

ConceptsConnections, actions, triggers, and the guarantees behind them.

ReferenceProviders, the HTTP API, error codes, and the SDKs.

TroubleshootingReconnect prompts, rejected keys, and failing deliveries.

Connect (concept)How Connect fits the wider Destesi suite.