How integrations work

An integration lets your project call an external service without you writing the HTTP calls or storing tokens yourself. You can post a Slack message, create a Google Calendar event, read a GitHub repository or generate text with Claude. Anythink defines each provider. You connect your project to it, then call it from a workflow's Integration step.

This page explains the model. To connect your first integration, see Post to Slack when a record is created.

Definitions, connections and operations

Part	What it is
Definition	A provider: Slack, GitHub, Google Calendar. Anythink maintains these. Each has an auth type, the OAuth scopes it requests and a list of operations.
Connection	Your project's link to a definition: a name plus encrypted credentials. A project can hold several connections to the same provider.
Operation	One thing a provider can do, such as Slack's `send-message` or Google Calendar's `create-event`, with a fixed set of inputs and a fixed output.

Integrations reference: providers and operations lists every provider, operation, input and output.

See what's available

In the Anythink dashboard

Go to Settings › Integrations and open the Integrations tab.
Each provider has a card. A card shows Connected when the project has a connection, and Configure & Connect when it doesn't.

Only project administrators can open this page.

With the CLI

bash

anythink integrations list
anythink integrations get google-calendar
anythink integrations connections list
anythink integrations connections list --provider slack

integrations list shows each provider's key, category, auth type and operation count. integrations get adds the provider's operations and, for Google Calendar, its parent provider. connections list shows the connections you can see: each one's ID, provider, name, owner and whether it's enabled. No command prints a connection's credentials.

With an AI assistant (MCP)

text

List the integrations available in this project and which ones are connected.

The assistant calls the cli tool with integrations list and integrations connections list. Integration commands need the MCP server running locally in stdio mode. The hosted HTTP server doesn't run them.

Project connections and user connections

A connection belongs either to the whole project or to one user:

Project connection (the default): any workflow can use it. Use it for a team Slack workspace or a shared booking calendar.
User connection: one user links their own account, and only jobs that user triggers can use it. Use it when a workflow should act as the person who triggered it. Other users never see it.

The dashboard creates project connections. Create user connections with the CLI's --user-connection flag, or with is_user_connection: true on the API. See Let each user connect their own account.

OAuth and API-key providers

Each definition has one auth type, and the auth type decides how you connect:

Auth type	Providers	How you connect
OAuth2	Slack, Google Calendar, GitHub, LinkedIn, X	Register an OAuth app with the provider, save its client ID and secret in your project, then approve access in the browser.
API key	Claude, OpenAI, Grok	Paste the key once. Anythink stores it encrypted.

For OAuth providers, Anythink exchanges the authorisation code for an access token and, where the provider issues one, a refresh token. The OAuth app belongs to your project, so the consent screen shows your app's name, and you control its scopes and redirect URLs. See Connect Slack to send messages from workflows and Connect Google Calendar to create events from workflows.

Note: Google, GitHub, LinkedIn and Apple can also be used for social sign-in, which lets your users log in with that provider. That's configured on the Social Sign-In tab and uses a different callback URL from integration connections. Most providers allow one callback URL per OAuth app, so use a separate OAuth app for each purpose. Google allows several redirect URIs on one OAuth client. See Social sign-in with Apple, Google, GitHub and LinkedIn.

Choosing a connection in a workflow step

Each Integration step has a Credential Source (credential_source in the step's parameters) that decides which connection it uses:

Credential Source (dashboard)	Value	Uses
System (shared connection)	`system`	An enabled project connection for the provider. This is the default.
Current User (first connection)	`current_user`	An enabled connection visible to the user who triggered the job: their own user connection or a project connection.
Specific Connection (by ID)	`connection`	The connection with the ID in `connection_id`. If no connection has that ID, the step falls back to `current_user`.

json

{
  "provider": "slack",
  "operation": "send-message",
  "credential_source": "system",
  "inputs": {
    "channel": "#orders",
    "text": "New order from {{ $anythink.trigger.data.customer_email }}"
  }
}

The triggering user is whoever caused the event: the user whose API call created or updated the record, who pressed a workflow button, or who called the workflow's API route. A timed workflow has no triggering user, so current_user can only find project connections.

When more than one enabled connection matches system or current_user, Anythink doesn't guarantee which one it picks. Keep one enabled connection per provider for those sources, or use Specific Connection (by ID).

What a step does at runtime

The step finds the connection for its credential source. If there isn't one, it fails with No credentials found for <provider> and names the service to connect.
If an OAuth access token has expired and the connection has a refresh token, the step refreshes it and saves the new token before calling the provider.
The step fills in {{ }} expressions in its inputs. See Template syntax.
The step runs the operation against the provider's API and saves the result under its key, at the top level. Read it with {{ $anythink.steps.<key>.<field> }}.
If the provider rejects the call, the step fails with the provider's error, such as Slack API error: invalid_auth. Link the step's failure handle to another step to handle it. See Step types.

How credentials are handled

Connection credentials (access tokens, refresh tokens and API keys) are encrypted at rest and decrypted only on Anythink's servers when a step needs them. The dashboard, the CLI and the API return a connection's ID, name, provider, owner, enabled flag and timestamps, never its credentials. Don't put credentials in workflow inputs or record fields. Use a connection.

Parent providers

Google Calendar has Google as its parent provider. If Google Calendar has no OAuth client of its own, it uses the Google client saved for your project. A project that already has Google sign-in set up can connect Google Calendar without registering another app. Google Calendar is currently the only Google service available as an integration.

Turning things off

Disable a connection to stop workflows picking it up without deleting its credentials: anythink integrations disable <connection-id>. Re-enable it with anythink integrations enable <connection-id>.
Disconnect to delete the connection and its credentials: Disconnect in the dashboard, or anythink integrations disconnect <connection-id>.

See Rotate, pause or disconnect an integration for the full procedure.

Where connections are used

The Integration workflow step calls one operation with a connection chosen by its credential source. See Step types for its parameters.
The AI sidebar's bring-your-own-key mode uses the project's claude, openai or grok connection instead of Anythink's shared AI quota. See How AI chat and MCP work.

Permissions

Every integrations endpoint needs the anythink_integrations permission: read to browse definitions and connections, create to connect, update to enable, disable or configure OAuth, and delete to disconnect. The Settings › Integrations page is also limited to project administrators. See Control access: roles, permissions and field-level security.

Limits

Limit	Detail
User connections	One per user, per provider, per project. Connecting the same provider again as the same user is rejected. Disconnect the old one first.
Connections in the dashboard	The dashboard shows and manages one connection per provider. Add more project connections with the CLI or API.
Connection choice	`system` and `current_user` pick any matching enabled connection, in no guaranteed order.
GitHub results	List operations return one page of up to 100 results. There's no page input.
Connection test	`anythink integrations test` confirms the connection exists. It doesn't call the provider. Run the workflow to check the credentials work.
Callback URLs	Most OAuth providers allow one callback URL per app, so social sign-in and integration connections for the same provider need separate apps.
Assistants	Integration commands run through the MCP server in stdio mode only.

Next steps

Post to Slack when a record is createdConnect Slack to your project, then build a workflow that posts to a channel whenever a record is created. Every step in the dashboard, CLI or an AI assistant.

Integration providers and operationsEvery integration provider and operation, with auth type, parameters and outputs, for Slack, Google Calendar, Google Analytics, Search Console, GitHub, LinkedIn, X, Claude, OpenAI and Grok.

Slack and Google Calendar workflow recipesFour tested workflows that alert Slack about big orders, message an assignee, create Google Calendar events with Meet links and keep them in step.

Step typesEvery workflow step type, with its parameters, the output later steps can read, how it fails, and an example you can copy.