Connectors

Open in workspace →

Connectors let your workflows call external APIs securely. A connector stores the URL patterns your workflow is allowed to reach, along with the secret (like an API key) used to authenticate. The secret is encrypted at rest and injected into requests automatically, so it never appears in your workflow code.

Connectors are used by code action steps. When a code step runs, it can only make HTTP requests to URLs that match a connector’s allowed patterns.

Creating a connector

1. Navigate to AI > Connectors in the dashboard.
2. Click Add connector.
3. Choose a provider: Stripe (preset) or Custom.

Stripe

The Stripe preset comes preconfigured. URL patterns and authentication are set up for you (requests to https://api.stripe.com/* with a Bearer token header), so you only need to provide a Stripe API key. Use the restricted key from the Optlo app on the Stripe App Marketplace rather than your standard secret key.

For what the agent can answer from Stripe and why the key can’t move money, see the Stripe integration overview.

Install the app and connect it:

1. Open the Optlo listing on the Stripe App Marketplace and click Install. Stripe shows the permissions the app requests before you confirm. Sandboxes are supported if you want to try it on test data first.
2. After installing, Stripe opens the app’s settings page. You can return to it any time from Installed apps in your Stripe Dashboard settings.
3. Click View API keys at the top of the settings page and copy the restricted key. It starts with rk_live_ (or rk_test_ in a sandbox).
4. Click Open Optlo, pick your workspace, and paste the key. The connector form opens with the provider and name already filled in.
5. Turn on the Stripe integration in the Support or Triage preset.

What the key can do:

Stripe permission	Access	Used for
Subscriptions	Read	Showing a verified customer their plan, status, and renewal.
Invoices	Read	Listing a verified customer’s recent invoices with links to view or pay.
Products	Read	Naming the plan on a subscription or invoice line.
Customer portal	Write	Creating a billing portal session link for that customer.

That is the whole list. The key can’t read charges, payment methods, or customer records, and it can’t issue refunds, change subscriptions, or create anything other than billing portal sessions. Customers make any billing change themselves in Stripe’s portal.

Needing more access: Stripe doesn’t let you edit the permissions of a key created by an app. If your own code steps need to call other Stripe endpoints, create a restricted key yourself in the Stripe Dashboard under Developers > API keys, give it the permissions above plus the ones you need, and paste that key into the connector instead.

A standard secret key (sk_live_) also works, and the form warns you when you paste one. It grants full access to your Stripe account, so a leaked key exposes far more than the restricted one would.

If Stripe rejects a request because the key is missing a permission, the connector shows an alert badge, workspace owners get an email, and the error log includes Stripe’s explanation of which permission was needed.

Custom

For other APIs, configure the connector yourself:

Setting	Purpose
Name	A label for this connector (must be unique within your workspace).
Allowed URL patterns	The URLs your code is allowed to call. Must use HTTPS. Supports wildcards, for example https://api.example.com/v1/*. You can add up to 20 patterns.
Secret placement	How the secret is attached to outbound requests (see below).
Secret	The API key or token used to authenticate. Encrypted at rest.

Secret placement

The secret can be attached as a header or a query parameter.

As a header, you specify the header name and a template containing {{secret}}. For example, an Authorization header with the template Bearer {{secret}} sends Bearer sk_live_abc123 on every request.

As a query parameter, you specify the parameter name and the secret is appended to the request URL.

Monitoring

The connectors list in the dashboard shows request and error counts from the last 24 hours. If a connector has errors, it displays an alert badge. Click through to see the error log with details like HTTP status, method, host, and timestamp.

How connectors work at runtime

When a code step lists a connector, the workflow grants that code access to the connector’s URLs. The code uses standard fetch() calls. Before each request reaches the external API, the system checks the URL against the connector’s allowed patterns, injects the secret, and strips cookies. If the URL doesn’t match any pattern, the request is blocked.