Connections
A product that cannot reach your systems is a demo. Every API in the store ships with a machine-readable spec the platform already holds, so what gets built against it is checked rather than guessed. You bring your own credentials, OAuth is handled for you, and anything not listed can be added.
The connection model
The store is not a wall of logos. Behind each entry — GitHub, Gmail, Google Drive, HubSpot, Intercom, Jira and the rest — the platform holds the vendor's API contract as a document it can read, diff and enforce. An agent building a feature builds against that contract, and what it built is checked back against it. Integrations rot when the code's idea of an API drifts from the API itself. A held contract is how that drift gets caught. The count is strict on purpose: a connection is only counted once its full endpoint spec is held — an incomplete contract cannot be checked, so it does not count.
The six-way audit
A connection that merely says “connected” is telling you almost nothing. Here, every connection is audited six ways, including: a real call that proves the credential actually works; the stored spec compared against the vendor's current document; the code that was built checked against the spec it was built from; and failures on the wire surfaced, not swallowed. In the screenshot below, four of the six checks show amber or red. That is the point — a badge that is always green is decoration; a check that can fail is information. An integration that fails in production is friction between the founder and revenue — the audit exists so it fails here first, not in front of your customer.
In production
Making Tax Digital — a live product on this platform, built for UK landlords — runs four connections in production: AgentOS Landlords (verified), HMRC Making Tax Digital, TrueLayer, and Open Banking via Plaid. In the last 24 hours those connections carried 825 API calls. How the product came to exist is its own story — here it stands for one thing only: connections carry production traffic.
Not in the store
The store is a head start, not a boundary. An API that is not listed — a niche vendor, a legacy system, something built in-house — can be added as a custom connection, so a missing logo never becomes a missing feature.
Your credentials
Every connection runs on credentials you supply, at the scope that fits: one shared key across the whole product, or each end user connecting an account of their own. Where a provider uses OAuth, the platform runs the whole flow — consent, tokens, refresh — so a working integration never rests on a secret pasted into code.
One key, supplied once, powers the whole product.
End users connect their own accounts, each with its own credential — nothing shared between them.
Consent, tokens and refresh are the platform's job, not your code's.
