# Connect your app’s services

Configure scoped connections and read what was actually observed.

Version 0.1.0 · Early pilot · unreleased SDK · Reviewed 4 November 2026

## Start in Integrations

Open Settings → Integrations and select the exact app and environment. Owner/admin settings use revision checks and saved request identities; secrets are encrypted on the server and are not returned. A configured credential, authenticated webhook, registered endpoint, provider acceptance and device observation are separate states. Native chat works without optional providers. These provider routes are implemented in the MongoDB hosting profile; local adapter fixtures are not live connections.

## Subscription webhooks

RevenueCat, Superwall and Adapty have authenticated raw-body intake, durable event deduplication and app/environment checks. Copy the server-generated webhook path into your provider’s settings. Trusted host-signed provider bindings determine a customer match; SDK metadata, email and reported provider IDs cannot. Unknown subjects remain unmatched. A verified webhook snapshot is timestamped evidence requiring reconciliation, not a guarantee of current entitlement, purchase attribution, refund or revenue. No live subscription-provider account is connected in this release review.

## Telegram: register, link and confirm

An owner may explicitly register the configured bot’s webhook on hej’s public HTTPS endpoint. Uncertain setup reuses the saved operation and checks getWebhookInfo; it does not blindly repeat setWebhook. Registration is not message delivery. Each teammate then uses a one-use private link and explicitly confirms their sender/chat binding. Replies must target a stored message route with its exact binding revision and live app grant. Shared groups cannot receive private customer content or act as reply authority. Bot keys and a real private reply canary remain owner setup gates.

## Apple push: host opt-in

The host owns notification permission, APNs registration, signing entitlement and delegates. Forward fresh tokens using support.push.setDeviceToken, then synchronize only under the current support account. Server jobs recheck the installation, permission, account session, topic, environment and connection revision. Notifications contain generic text and an opaque route; resolve that route with the current SDK session on tap. APNs acceptance is not physical-device receipt/display. Real signing/provider credentials and physical-device proof remain separate gates.

- [Native SDK reference](/docs/sdk-reference)

## Support agent, payments and email

Support agent settings separately govern approved knowledge, drafts, summaries and tightly bounded automatic text replies. The current offers are US$15/month and US$150/year, both recurring until canceled. Historical nonrenewing orders retain their original terms and exact saved retries; they are not the current new-purchase offer. Workspace billing is separate from host customer subscriptions. Existing hosted sandbox payment/webhook and transactional-email observations do not establish production access or a new provider connection. The approved five-request synthetic OpenAI canary is complete: a grounded draft and one exact approved automatic reply were verified, while three summaries escalated for human review. The agent was disabled afterward and that request budget is exhausted. This is not general model-quality or production-AI verification.

- [Support agent and knowledge](/docs/support-agent)
- [Current evidence boundaries](/docs/release-status)