Connectors Overview
What's a "connector"? (in plain English)
Real apps don't do everything by themselves. Think about apps you use every day:
- WhatsApp doesn't make its own credit card system. It uses Stripe when you buy stickers.
- Most apps don't write their own maps from scratch. They show someone else's maps inside their app.
- Apps that email you receipts don't have their own email factory. They pay a service to send it.
- Apps that let you sign in with Google obviously don't own Google. They plug into Google's sign-in.
Each one of those is a connector. Other companies have spent years building the painful parts (taking payments, drawing maps, sending email reliably) and let other apps plug in. You get years of work in an afternoon, and the user never knows.
Don't worry about most of these on day one. Your first app needs Supabase, because every real app needs a place to remember users and data. The others (payments, email, maps, push) only come up when your specific app actually needs them. Many apps never touch most of them.
Connectors are account-wide: connect a service once and every project in the account can use it. Connecting requires a paid plan - the catalogue is browsable on every plan.
Two clear kinds
Managed connectors - Connect once in the dashboard
These have a page inside your Appsanic dashboard. You connect the service once - by OAuth or by pasting keys - and Appsanic stores the credentials encrypted server-side. From then on, every prompt that touches that service uses the connection automatically, and for some services the AI can act inside your account on your behalf. The first time the AI uses a connected service in a conversation, it says so briefly in its opening sentence ("Using your connected Mapbox for the map view…") - and when Account access is on, it announces account work up front.
The sixteen managed connectors today:
| Service | What you get by connecting |
|---|---|
| Supabase | The AI designs your tables, sets row-level privacy, manages auth, and seeds data inside your project. |
| Stripe | The AI creates products + prices in your account and registers webhook endpoints with their signing secrets. |
| Resend | The AI registers your sending domain, hands you the DNS records, and provisions a scoped sending key. |
| OpenAI | Your key, stored safely, for GPT chat, embeddings, Whisper, and image generation in your app. |
| Anthropic | Same - your Claude key for reasoning, chat, and structured-output features. |
| PostHog | Event capture, screen tracking, and feature-flag reads with your project key. |
| Sentry | Crash reporting and performance monitoring wired in with your DSN. |
| RevenueCat | Native in-app purchases and subscriptions with the right platform key on each device. |
| Twilio | SMS, phone-OTP sign-in via Verify, and WhatsApp messaging. |
| OneSignal | Production push notifications with segmentation and delivery analytics. |
| Mapbox | Vector maps, geocoding, and directions with your public token. |
| Google Maps | Map screens built from static map images, geocoding, and routes with one API key - turn-by-turn hands off to the Google Maps app. |
| Algolia | Fast, typo-tolerant search with your Application ID and a search-only key (never the admin key). |
| Replicate | Image, video, and audio AI models, paid by the GPU-second. |
| Expo Push | Stores your Expo access token so a server can send push notifications. (Receiving push already works in every generated app, no connector needed.) |
| AdMob | Banner and other ad units via your public App and ad-unit IDs - real ads in built apps, clearly-labeled placeholders in the preview. |
Connecting doesn't mean the same thing for every service, because keys come in genuinely different kinds. Three honest tiers:
- Just connect. The key is public by design and is bundled into your app: Mapbox, Google Maps, PostHog, Sentry, RevenueCat, OneSignal, Algolia, AdMob. Connect once and the AI embeds the value wherever the app needs it.
- The AI works in your account. Supabase, Stripe, and Resend come with an Account access toggle - off until you opt in. Switched on, the AI sets things up inside your account with server-side tools (it never sees the admin keys), and every action lands in the Activity feed at the bottom of that connector's page.
- Connect + a tiny relay. OpenAI, Anthropic, Replicate, Twilio, and Expo Push use secret keys that must never be bundled into an app people download. See Secret keys and the tiny relay below.
→ You can also connect any of these directly from inside a build the moment the agent asks. See In-Chat Connect Cards.
Scaffolded connectors - the agent writes the code, you bring the account
Everything else. There's no Connect page in Appsanic for these, but ask explicitly and the agent wires them up best-effort: it installs the library, builds the screens, and writes the wiring. It will tell you up front that the service isn't a managed connector - no encrypted key storage, no account tools, no activity log - and it follows strict safety rules to make up for that: it asks you to create a brand-new, minimum-permission key (never a production or master key), routes anything secret through a server-side relay rather than the app itself, and reminds you that any value shared in chat should be rotated once setup is done.
Anything with a documented API works this way: describe the service, give the agent the endpoint and auth method, and it generates the client code with a credential slot.
The connector page (dashboard)
Dashboard → Connectors is a gallery of all sixteen managed connectors with category filters (including Ads and Search) and a live status on every card. Click a card to open the per-connector page:
- An honest status pill - Connected, Needs attention (the stored error is shown), or Not connected. The page never claims a connection it hasn't verified.
- One-click OAuth - "Connect with Supabase" / "Connect with Stripe" where the deployment has the provider's OAuth configured. The Supabase flow always includes a confirm step: after you approve, you pick which Supabase project to connect (pre-selected if you only have one). Paste-keys fields are always available beneath as the fallback.
- Saved secrets shown as dots - stored secrets never round-trip to the browser. You see that a key exists, encrypted, not the key itself.
- "How to find your keys" - step-by-step pointers to the exact pages in the provider's console, so you're never hunting.
- The Account access toggle - off by default. Flipped on, the AI sets things up inside your account with server-side tools (creating tables, products, webhook endpoints). Left off, the AI writes the code plus step-by-step setup instructions and you run them yourself. Toggle changes take effect on the next build. Only services with account-level tools (Supabase, Stripe, Resend) show the toggle.
- Test connection - re-checks the saved credentials against the live service any time.
- Disconnect - removes the stored credentials, behind a confirmation dialog.
- Activity - at the bottom of the page, a list of every action the AI performed with this connector: what it did, when, and whether it succeeded. Inputs are stored with secrets stripped, so the feed is safe to read over anyone's shoulder.
The build page has its own door to all of this: the plug button in the composer opens a connectors modal - the gallery first, then the provider with the real connect form right inside the modal. Same form, same validation, same OAuth (which opens a new tab; the modal detects completion automatically). Connecting never navigates you away from a running build.
Secret keys and the tiny relay
One honest wrinkle worth understanding. Some providers' keys are secret - anyone holding the key can spend your money (OpenAI, Anthropic, Replicate, Twilio, Expo Push). Those keys can never be bundled into an app people download.
So for these providers, the generated app calls the provider through a small relay - a tiny piece of server code that holds the key in its own environment. The agent writes the app to talk to the relay and generates clear setup instructions alongside it. Better still: with Supabase connected and Account access on, the AI deploys the relay for you as a Supabase Edge Function - you just paste the key into your Supabase secrets, following the instructions it generates. Publishable-key services (Mapbox, Google Maps, PostHog, Sentry, RevenueCat, OneSignal, Algolia, AdMob, the Supabase anon key) don't need any of this - their keys are designed to be embedded, and the app uses them directly.
Something not on the list?
If the service has documented API endpoints (most modern SaaS does), the agent can usually wire it up from a prompt:
"Connect with [service name]. The endpoint I want is
GET https://api.example.com/items. Authentication is a headerX-API-Key: <key>. Put the key in an environment variable."
The agent generates the code, adds the credential slot, and wires it into your app - following the same safety rules as any scaffolded connector: a fresh minimum-permission key, secrets behind a server-side relay, and a reminder to rotate anything that ever touched the chat.
Swapping one service for another
The agent handles swaps. Some real examples:
"Move file storage from Supabase to Cloudflare R2. Keep Supabase for the database."
"Replace PostHog with Amplitude. Keep the same event names."
For managed connectors, connect the new service on its page and ask for the swap. For scaffolded connectors, the agent rewrites the code and updates the credential slots.
Credentials and security
Never paste secret keys into prompts. Keys belong in the connector pages, where they're handled properly. The AI holds the same line from its side: it will never ask you for credentials in chat, and if you paste a key into the chat anyway, it refuses to use it and points you to the connector page (and any key that's touched a chat should be rotated).
For managed connectors, everything you connect is encrypted with AES-256-GCM before being written to our database. Cleartext never lands in a row and never enters a log. The browser only ever sees that a secret exists - the dots on the form - never the value. Every action the AI takes with a connection is recorded in the Activity feed with secrets stripped. See the Security page for the full envelope detail.
For scaffolded connectors, the keys live in your project's environment variables - set on the server side of your app, never bundled into the client. The only key that's safe to embed in client code is the Supabase anonymous key (designed for browser use, protected by Row Level Security - see Database & Data) and the other publishable keys listed above. Everything else must stay server-side, and the agent enforces this when it wires up connectors.
See Environment Variables for the full mental model.
Next
Read Supabase. Your app's database, sign-in, file storage, and live updates, all in one. This is the connector every app needs.