Integrations
Connect 20+ tools via secure OAuth to power your AI Skills. Tokens are stored AES-256-GCM encrypted — your credentials are never stored in plain text.
How to Connect a Tool
- Open the user menu (top right) → Connections
- Find the tool you want to connect and click Connect
- You'll be redirected to the tool's OAuth consent screen
- After approval, you're redirected back and the connection is active
- Admins can also set company-level connections that all team members share
Available Integrations
Google Workspace
| Tool | Default OAuth Scopes |
|---|
| Google Sheets | spreadsheets.read / write |
| Google Drive | files.read / write |
| Google Calendar | calendar.read / write |
| Gmail | mail.modify |
| Google Docs | documents.read / write |
Communication
| Tool | Default OAuth Scopes |
|---|
| Slack | chat:write, channels:read |
| Discord | identify, guilds |
| Microsoft Teams | Chat.ReadWrite |
| Microsoft Outlook | Mail.ReadWrite |
CRM
| Tool | Default OAuth Scopes |
|---|
| HubSpot | crm.objects.contacts.read |
| Salesforce | api, refresh_token |
| Zendesk | read, write |
Productivity & Storage
| Tool | Default OAuth Scopes |
|---|
| Notion | read, write pages |
| Airtable | data.records.read / write |
| OneDrive | Files.ReadWrite |
Project Management
| Tool | Default OAuth Scopes |
|---|
| GitHub | repo, read:user |
| Linear | read, write |
| Jira | read:jira-work, write:jira-work |
| Asana | default |
Commerce & Payments
| Tool | Default OAuth Scopes |
|---|
| Shopify | read_products, write_products |
| Stripe | read_write |
Token Refresh
Fluxopus automatically refreshes expired OAuth access tokens before skill execution using the stored refresh token. If a refresh token expires (e.g. Slack tokens expire after 90 days of inactivity), you will need to reconnect the tool.
Security
All OAuth tokens (access + refresh) are encrypted with AES-256-GCM before being written to the database. The encryption key is stored separately from the database. Tokens are only decrypted in memory at the moment of use and are never logged or sent to third-party services other than the intended tool.