Sign in and build · Free to start, no card needed · add a card when you want more credit · see pricing →

Integrations

Connect once. Every machine after.

A machine is destroyed within the hour, so a credential stored inside one is gone by lunchtime. Connected accounts live with your account instead, and are handed to every new machine at boot.

Start building See security

Connect GitHub, Cloudflare, Hetzner and Vercel and 15 others once. Every machine you ever start after that can reach them, and no endpoint here will hand the credential back to anyone.

ameliasagent.com/app

Connect my GitHub so it can push there directly.

OAuth · scoped to your repos onlyconnected · reused by every machine after

What connects today

19 connect today, and 12 more are coming.

Connected accounts and the access they grant
AccountMethodScope
GitHubOAuthRead and write your repos.
CloudflareAPI keyDNS and zones managed for you.
HetznerAPI keyCheap always-on servers.
VercelAPI keyDeploy to your own Vercel account.
SentryAPI keyThe exact access is shown before you connect.
GlitchTipAPI keyThe exact access is shown before you connect.
PostgreSQLAPI keyRead a database your business already runs.
MySQLAPI keyRead a MySQL database you already run.
S3-compatible storageAPI keySomewhere for uploads and files to live.
SMTP (any mail server)API keySend from a mailbox you already have.
ResendAPI keyContact forms that actually arrive.
TwilioAPI keySend SMS from your own number.
MailchimpAPI keySign-ups go to the audience you already send to.
Cal.comAPI keyShow real availability on the site.
PayPalAPI keyTake PayPal alongside cards.
ShopifyAPI keyReal stock and real prices on the site.
OpenAIAPI keyFor the app you are building, not for Amelia.
AnthropicAPI keyFor the app you are building, not for Amelia.
AirtableOAuthRead and write the bases you choose.
The scope is shown before you connect, not buried in a consent screen you scroll past.

Coming, and not connectable yet: Stripe, Railway, Google Search Console, Google Business Profile, Gmail, Supabase, Slack, Notion, QuickBooks, Xero, Square and HubSpot. The app draws a card for each of these and leaves it disabled rather than hiding it, so you can see what is on the way — but nothing here works today, and any page of ours that implies otherwise is wrong. Stripe is the one people ask for most; if you need to take card payments on a site now, write in and we will tell you where it stands.

Where it lives

Connected once, at your account.

Sealed at rest, and injected into a machine's environment at boot — never written to disk, never returned by an API. A machine lives an hour; a relationship with your GitHub account does not.

Connected once, at your account

Sealed at rest, and injected into a machine's environment at boot — never written to disk, never returned by an API.

Monday’s machinedestroyed by lunchtime
Tuesday’s machinedestroyed by lunchtime
Every machine after thatsame accounts, no reconnecting
This is the reason connected accounts are not stored on the machine that uses them. A machine lives an hour; a relationship with your GitHub account does not.

OAuth first, deliberately

A key can only be revoked by whoever holds it.

Where a provider offers OAuth we take a scoped token you can revoke from that provider's own dashboard — without needing us to be reachable, honest, or still trading. For an API key, the only party who can revoke it is us. So keys are the fallback, not the default, and where one is unavoidable the page tells you how to scope it as narrowly as the provider allows.

An API key
  • Revoked only by whoever holds it — which, for a pasted key, means us
  • Usually scoped by whatever the provider’s token editor allows
  • Works everywhere, including providers with no OAuth at all
The fallback
OAuth
  • Revoked from the provider’s own dashboard, by you, at any time
  • Scoped to exactly the permissions listed before you press connect
  • Does not depend on us being reachable, honest, or still trading
The default wherever it exists
Two of the 19 connect by OAuth today (GitHub and Airtable); the rest are keys because those providers offer nothing better — and for those, the page tells you how to scope the token down before you make it. Most of what is still coming is waiting on an OAuth app of ours, not on the connector.

How they are held

Sealed, and never handed back.

Encrypted at rest

AES-256-GCM with its own random value per record, so a modified ciphertext fails to decrypt rather than quietly returning something else.

The key is not in the database

It lives in the environment. A dump of the database alone is not enough to use anything in it.

The API returns booleans

Connected or not, which account, when. No endpoint returns a secret — not to you, not to the app, not to a machine other than the one it was issued for.

When it needs one

It asks with a button, not by improvising.

If a job needs an account it cannot reach, the agent stops and says so, and the app turns that into a connect button. It is instructed never to invent credentials, never to ask you to paste a key into the chat, and never to carry on as though the account were already connected — three failure modes that are much worse than stopping.

Connect what you already use.

Your accounts stay yours, revocable from their side, sealed on ours.

Get started See pricing

Questions

Asked, answered

What can I connect?

19 accounts today — GitHub and Airtable by OAuth and the rest by a scoped API key. The exact access each one grants is shown before you connect. Another 12, Stripe among them, appear in the app as cards that are not connectable yet.

Where are my credentials stored?

Encrypted with AES-256-GCM against your account, with the encryption key held in the environment rather than the database. No endpoint ever returns one.

Can I disconnect?

Yes, from here at any time — and for the OAuth ones, from the provider's own dashboard without involving us at all.