Integrations

Connect an account and choose exactly what StoriBot may do with it. Reads, writes, and the ones that cannot be undone are granted separately.

How it works

1. Connect an account. Pick the system on the Integrations page. You either approve StoriBot at the provider (OAuth) or paste a key you created there. StoriBot never sees your password.
2. Choose the operations. Every system is a list of operations, each marked Read, Write or Irreversible. Tick the ones StoriBot may use. Nothing is ticked for you.
3. Use it. StoriBot reads and writes only through the operations you ticked. Anything else is refused and logged.
4. Change your mind. Untick an operation, or revoke all of them, at any time. Rotate a pasted key, reconnect an OAuth account, or disconnect the system, from the same page.

The three kinds of operation

Kind	What it can do	Example
Read	Look at data. Changes nothing.	List invoices in Xero.
Write	Add or change something, and it can be changed back.	Create a contact in HubSpot.
Irreversible	Delete, send or post something that cannot be undone from here. Grant only what StoriBot may do unattended.	Post to a social account through Zernio.

Safe Integrations

Safe Integrations is a switch in Settings. On, which is the default, StoriBot can only read from connected accounts: Write and Irreversible operations cannot be granted, and turning it on removes any that were. Off, they can be granted one at a time. It is the one switch that disables every write.

How your keys are protected

A model can be talked into things, so it is never given the keys. The model that does the work never holds your credentials. A key or token you connect is encrypted and held in AWS Secrets Manager in Sydney, and only one component can read it: the integration proxy. The working session where StoriBot runs is a separate environment with no copy of the key and no permission to read one.

The key moves only between its store, the proxy and the provider. It never reaches the session.

When StoriBot needs something from a connected system, the session names the operation and its parameters. The proxy then, in order:

1. Checks the session is genuine and still running, and takes the organisation from the session’s own record, never from the request.
2. Checks that this operation was granted by your organisation, then decrypts the credential, last, and only for that call.
3. Builds the request itself from the connector’s definition, so the session cannot choose a URL, calls the provider, and returns only the answer, capped in size. The credential never travels back.

Every call is written to the audit log with its outcome. A session that has ten calls refused in a row is cut off from integrations for the rest of its run. OAuth tokens are refreshed by the proxy; if the provider will not refresh one, the call is refused and StoriBot tells you the system needs connecting again.

Security reviewers: the named services, the policy on the secret and every check in order are on the Architecture page.

Connected systems

System	Reads	Writes	Connect with
Stripe	Yes	No	Restricted API key
Xero	Yes	No	OAuth
MYOB	Yes	No	OAuth
Business Central	Yes	No	OAuth
Shopify	Yes	No	Admin API token
HubSpot	Yes	Yes	OAuth, or a private app token
PostHog	Yes	No	Personal API key
Amplitude	Yes	No	API key and secret key
Jira	Yes	No	API token
Airtable	Yes	No	OAuth, or a personal access token
Granola	Yes	No	API key
Deputy	Yes	No	Permanent token
OneDrive and SharePoint	Yes	Yes	OAuth, after an administrator grants a folder or site
Dropbox	Yes	Yes	OAuth
Zernio	Yes	Yes	API key

Two ways to connect

• OAuth. You approve StoriBot at the provider, signed in as yourself. StoriBot never sees your password. The provider is asked only for the permissions the operations you ticked need, and you can withdraw consent at the provider without going through StoriBot.
• An API token. You create a key at the provider, scoped to what StoriBot should reach, and paste it into StoriBot. The key is encrypted and held in AWS Secrets Manager in Sydney. Rotate it from the Integrations page at any time.

Where a provider offers OAuth, StoriBot uses OAuth. A pasted key is offered only where the provider has no OAuth, or alongside OAuth where a customer prefers the key route.

Your system is not here

Any business file works as a source, and most systems of record import from a folder they watch, so a file written to OneDrive, SharePoint or Dropbox reaches far more systems than this list suggests. Where a direct connector is needed, we build it. Naming a system here is a support commitment, so this list carries only what has shipped.