Builder.io External Integrations
Slack
Slack installs should go through the Clips Settings OAuth flow (connect-slack,
/api/slack/oauth/callback) so each Slack workspace gets its own encrypted bot
token in app_secrets. SLACK_BOT_TOKEN is only a legacy single-workspace
fallback and must remain behind the team allowlist.
Link previews are handled by the unfurl webhook; see the video-sharing skill
for the /api/slack/unfurl contract, the required scopes and events, and which
clips may produce a playable video block.
Atlassian / Jira
Atlassian/Jira is available through the shared MCP integration catalog. It uses Atlassian Rovo MCP OAuth. Explain that an Atlassian organization admin may need to allow the Clips app domain and enable the required Read, Write, and Search permissions before the connection can complete.
Provider API boundary
Credentialed provider integrations normally belong on the shared provider API
substrate (provider-api-catalog, provider-api-docs,
provider-api-request). Clips has one deliberate exception: Google Calendar.
Calendar grants live in Clips calendar_accounts with encrypted app_secrets
token refs rather than core oauth_tokens, so raw provider requests would
bypass the account sharing/status boundary. See the meetings skill before
touching that path.
Related skills
video-sharing— Slack unfurl route, scopes, and playable-clip rules.meetings— Google Calendar connection model and why raw provider requests are not wired up yet.security— encrypted per-workspace credential storage inapp_secrets.