Get started

Identity & access · Integrations

Connect anything. Your agents never touch the keys.

External services connect to Quox through the vault. An agent calls the tool it needs; the credential behind it stays server-side, and every use leaves a receipt.

What it is

One connection, made once, used everywhere.

An external service is connected once, through the vault, not pasted into every agent that needs it. Agents call it through a governed tool, and the secret behind that tool never reaches the agent, the model, or the browser: only the platform's server-side layer ever holds the raw value.

How it works

Store it once. Resolve it just-in-time. Receipt every use.

01

Store the credential

A secret is written to the vault once, encrypted with keys scoped to your own organisation, never a shared key across tenants.

02

Resolve it just-in-time

When a governed tool call needs the credential, the platform resolves it at the moment of use. It is never handed to the agent or the model ahead of time.

03

The call runs, and lands as a receipt

The external call executes server-side, and its use of the credential is written to the evidence trail: who, when, which tool, no secret value in the record.

Three properties

What holding the secret this way buys you.

01

Server-side only

Secrets never return to the frontend or the model. A prompt, a log, or a transcript never carries the raw value.

02

Per-organisation keys

Each organisation’s credentials are encrypted under its own key, so one tenant’s vault gives another nothing to read.

03

Every use receipted

Each integration call leaves an evidence entry: which credential, which tool, when, and the outcome.

Wired today

29 connectors proven live, end to end, with real credentials.

Each carries a committed proof: real credential, live instance, every read tool answering real data. In all, 222 connectors are wired: a hand-written core in daily production use, plus declarative specs that register only with a green proof against their real host and promote to proven the day a live credential run goes green. The rest of the catalogue below is credential types the vault already stores and tests, waiting on a connector.

GitHub
Google Sheets
Google Drive
Google Calendar
Stripe
Shopify
PayPal
Mailchimp
Notion
WhatsApp Business API
Telegram Bot
Discord
Trello
Dropbox
Figma
HubSpot
Airtable
Asana
Jira
Datadog
Cloudflare
YouTube
GitLab
Zoom
Pinterest
Facebook Messenger
Wix
Squarespace
Terraform Cloud
Postman

Data & AI

ANAnthropic
ASAssemblyAI
CHChroma
COConfluent Cloud
CouchDB
DADataForSEO
DBdbt Cloud
DEDeepgram
DeepL
DEDeepSeek
Elasticsearch
ELElevenLabs
EXExa
FAfal.ai
FIFivetran
Google BigQuery
GOGoogle Gemini
GRGroq
HEHeyGen
Hugging Face
InfluxDB
LELeonardo AI
LULuma AI
Mapbox
Meilisearch
MIMistral AI
Neon
OPOpenAI
OPOpenRouter
OPOpenWeatherMap
PEPerplexity
PIPinecone
PlanetScale
Qdrant
Replicate
RURunway ML
SingleStore
STStability AI
TATavily
Turso
TYTypesense
Upstash
WEWeaviate
Wolfram Alpha

Developer & CI

APApify
Bitbucket
BUBugsnag
Buildkite
CircleCI
Gitea
Jenkins
Kong
LALaunchDarkly
Make (Integromat)
Netlify
npm
PIPipedream
Pulumi
Rollbar
Sentry
Snyk
SonarCloud
SonarQube
Sonatype Nexus
SPSplit
TRTray.io
Vercel
WIWindmill
WOWorkato

Cloud, hosting & identity

Bunny.net
Cloudflare Zero Trust
DigitalOcean
Docker Hub
Fastly
Fly.io
HashiCorp Consul
HashiCorp Nomad
HashiCorp Vault
HEHeroku
Hetzner Cloud
Kubernetes API
LILinode (Akamai)
Okta
Railway
Render
Scaleway
Tailscale
UpCloud
Vultr

Marketing & email

BEbeehiiv
Bitly
CUCustomer.io
DRDrift (Salesloft)
ITIterable
JOJotForm
Kit (ConvertKit)
KLKlaviyo
LILinkedIn
LILinkedIn Ads
MAMailjet
Meta Ads
POPostmark
Resend
SESendGrid
SurveyMonkey
TATally
Typeform

Monitoring & incidents

ALAlertmanager
Better Stack
Grafana
LangSmith
LOLoki
NANATS
NENetdata
New Relic
OpsGenie
PagerDuty
PAPapertrail
Prometheus
RARabbitMQ
Statuspage
TRTraefik
VIVictoriaMetrics

Communication

BABandwidth
Cisco Webex
CRCrisp
DIDialpad
FRFront
GOGotify
Intercom
LINE Messaging
MEMessageBird
MIMicrosoft Teams
PLPlivo
SLSlack
TETelnyx
TWTwilio
Viber Bot
Zendesk Chat

CRM, sales & support

ACAcuity Scheduling
APApollo.io
Cal.com
Calendly
CLClose
GOGong
Help Scout
OUOutreach
PIPipedrive
SASalesloft
Zendesk
Zendesk Sell

Media

ADAdobe Creative Cloud
Cloudinary
GEGetty Images
Pexels
SHShutterstock
Spotify
Threads (Meta)
Twitch
Unsplash

Commerce & finance

Adyen
BigCommerce
Brex
Gumroad
Lemon Squeezy
Paddle
RERecurly
Square
Wise

Files & knowledge

Box
Coda
Contentful
Directus
Dropbox Sign
Google Docs
PAPandaDoc

Project management

ClickUp
Linear
MOMonday.com
SMSmartsheet
Todoist
WRWrike

HR & hiring

DEDeel
Greenhouse
HiBob
LELever
RIRippling

More

FAFacebook Pages
INInstagram
MIMikroTik RouterOS
TITikTok
Twitter/X

See it

Where you add one.

The vault's browse view inside the dashboard: search the catalogue, pick a service, and connect it. The credential is written to the vault, and from then on agents reach the service through a governed tool, never the raw secret.

The add-integration browse page in the QuoxCORE dashboard: the integration catalogue, searchable and grouped by category, with connected services badged
Browse the catalogue, search, and connect. The credential lands in the vault, not in the agent.

The full catalogue

One vault, 413 services.

Every credential is stored encrypted per organisation, resolved just-in-time, and receipted on use. The turnkey connectors listed above can be driven directly by an agent today, with more added every release; the rest of the catalogue is ready and waiting on a connector. A connector is the smaller, separate layer on top of the vault. The full 413 live in one place, not repeated here.

29
Connectors proven live: real credential, committed proof
222
Executable connectors: the hand-written core plus proof-gated specs
413
Services the vault stores and tests credentials for

Honest status

What is live, and what is still on the way.

The vault, per-organisation encryption, just-in-time resolution and receipted use are shipped and in use today. Named external connectors are the next layer on top, and are not claimed as shipped until they are.

Live
  • The vault itself: credentials stored server-side, never returned to the frontend or the model
  • Per-organisation encryption keys, so one tenant’s secrets are unreadable to another
  • Just-in-time resolution: a credential is fetched at the moment a governed tool call needs it, not handed out ahead of time
  • Governed tool calls that use a stored credential to reach an external service
  • A receipt on every use: which credential, which tool, when
In progress / planned
  • Further named external connectors beyond those wired today, produced by the connector factory wave by wave (Gmail among the next: its credential type is not in the vault registry yet)
  • Live-credential verification for factory connectors: they ship Beta, blind shape-proven against the real host with read-only tools, and are promoted only after a real credential run
  • A guided connect flow per named service, rather than storing a raw credential by hand

See it in place

Read how the vault holds the secret.

Integrations sit on top of the vault, which sits inside identity and access: one credential store, per-organisation keys, and a receipt on every use.