In-Chat Connect Cards
When a build needs a managed service that is not ready, the agent pauses and shows a connector card in chat. The card names the service, explains why it is needed, and may list a specific optional value that is still missing.
The agent must not ask you to paste a credential into chat or into a screen it generated inside your app. Credentials belong only in the trusted connector form.
What happens when you connect
Select Connect [Service]. The project build opens its connectors modal at the correct provider and shows:
- a step-by-step guide to finding each value;
- the provider's manual credential form;
- masked placeholders for secrets already stored;
- provider-specific server-side validation (a bounded live read where safe, or
an explicit format/shape-only result where no safe probe exists);
- Account access controls, where supported;
- management controls and secret-redacted AI activity for an existing
connection.
Connector OAuth is not currently available. Create a separate revocable, least-privilege key for this project and enter it in the connector form. Do not reuse a production master key when a restricted project key will work.
If the modal cannot open in the current page, Open setup opens a project handoff in a new tab. The connector still belongs to the project shown on the card; it does not become available to every project in the account.
How the card detects completion
While the latest card is waiting, connection status can update through the shared in-page cache, a same-browser notification, a short polling fallback, or the I'm done - check now control. The card requires both a healthy connection and any recognised optional fields named in the handoff. A provider that is connected but still missing a required detail does not resume early.
When the condition is satisfied, the card displays Resuming your build… and asks the server to continue the exact paused task. The continuation is accepted only when:
- the project, account, conversation, assistant message, and tool-use identity
all match;
- the connector is still healthy and has the required fields; and
- that assistant artifact is still the latest actionable message.
A stable idempotency key makes a browser remount, duplicate signal, or retry resolve to the same continuation instead of intentionally starting another one. If the connection saved but continuation failed, use Retry build continuation; you do not need to reconnect.
Older cards do not restart old work
If you send a newer message, the old connector card becomes a historical entry. It can reflect that the provider is now connected, but it cannot resume the superseded build. This prevents an old payment, database, or email setup request from restarting after the conversation has moved on.
If you still want the old feature, ask for it again in a new message.
Managing a saved connection
Open the connectors button in that project's build and select the provider. From there an owner or admin can:
- review status and last verification time;
- replace or clear optional saved values;
- select Test now to re-check the live service;
- review secret-redacted AI activity;
- change Account access where the provider supports build-time actions; or
- select Disconnect and confirm removal from the project.
Disconnecting removes Appsanic's encrypted copy. Revoke the key in the provider dashboard too if it may have been exposed or should no longer work anywhere.
Runtime secrets are a separate step
A successful card means the build system can use the project connector. It does not inject a secret into the app you publish.
If the feature needs a secret while users run the app, the agent should generate a narrow backend proxy or function plus deployment instructions. Deploy that backend and add the provider key directly to its server-side secret manager. The mobile or browser app should receive only the proxy URL and should never contain the raw secret or a credential-entry screen.
Publishable provider values are the exception: they may be placed in client code when the provider explicitly designed them to be public.
Common problems
The card is still waiting
Select I'm done - check now. If it remains waiting, reopen setup and check:
- the form actually saved rather than showing a validation error;
- Test now succeeds;
- any optional field listed on the card is present; and
- you connected the service in the same project as the paused build.
The provider says reconnect is required
Create or copy a fresh least-privilege credential, update the saved fields, and test again. A provider outage or a missing permission may not be fixed by rotating a key, so read the exact error before replacing it.
I pasted a key into chat
Delete or redact the message where possible, revoke the key in the provider dashboard, create a replacement, and save the replacement only in the connector form or deployed backend's secret manager. Treat any secret that entered chat as compromised.
I need a service that has no card
Tell the agent the service name, official docs, desired operation, API origin, and authentication type without providing the credential. It can use the constrained Custom API connector for an eligible read-only OpenAPI integration, or generate a manual backend integration for anything else. See Connectors Overview.