Integrations
UltimateTeam.ai connects to the systems your business already runs on. Each connector grants your agents specific tools; a per-connection permission policy controls what those tools may read and do.
Agent connectors
Section titled “Agent connectors”Connectors expose typed tools that agents call directly. All of them are managed from Settings → Connectors in the dashboard.
| Service | Purpose | Setup method | Primary agents |
|---|---|---|---|
| Stripe | Payments — revenue, subscriptions, customers, payouts | API key | CFO |
| QuickBooks | Accounting, P&L, cash flow ground truth | OAuth (in-app) | CFO |
| Shopify | Storefront orders, inventory, customers | OAuth (in-app) | CRO, CFO, CMO |
| HubSpot | CRM — contacts, deals, campaigns | OAuth (in-app) | CRO, CMO |
| Generic CRM | REST adapter for any tenant-configured CRM API | Access token / API key | CRO |
| Email Inbox | Read + search the platform’s own email activity | Built in — nothing to connect | CRO, CFO |
| Company-page posts + engagement | Provider access token | CMO, CRO, CIO | |
| X (Twitter) | Tweets, threads, media, engagement | Provider access token | CMO |
| Meta | Facebook page + Instagram publishing | Provider access token | CMO |
| Mailchimp | Bulk marketing campaigns + lists | API key | CMO |
| Google Analytics | Site traffic + conversion attribution | OAuth (in-app) | CMO, CIO |
Four more connectors appear in the same Settings list and follow the same flow; they do not have a dedicated guide yet:
| Service | Purpose | Setup method | Fields |
|---|---|---|---|
| Xero | Read-only USD accounting snapshot (requires Xero Advanced-tier approved Journals access) | OAuth (in-app), then pick the organization | — |
| WordPress | Stage drafts and publish approved articles | Application password | WordPress username, Application password, HTTPS WordPress installation URL, WordPress author ID |
| Stage Page media and publish approved posts | Provider access token (Page token) | Provider access token, Facebook Page ID | |
| Stage images, carousels and reels; publish containers | Provider access token (Page token) | Provider access token, Facebook Page ID, Instagram business account ID |
Channel providers
Section titled “Channel providers”Channel providers are the delivery rails the platform communicates through. They are configured at the platform level — there is nothing to connect in Settings — but each guide explains what you control per agent.
| Service | Purpose | Primary agents |
|---|---|---|
| Twilio | Voice calls, SMS, in-call payments | CRO, CFO |
| Resend | Transactional and outreach email delivery | CRO, CFO, CMO, COO |
Gmail is not an integration: the platform never polls an external mailbox. See Email Inbox.
Plan limits
Section titled “Plan limits”Every connector instance — native or built with Connector Forge — counts toward one quota:
| Plan | Integrations |
|---|---|
| Starter ($999/mo) | 5 |
| Professional ($2,499/mo) | 15 |
| Business ($4,999/mo) | Unlimited |
| Enterprise | Unlimited |
Connectors in pending_auth, error, or disabled still occupy a slot;
only an explicit disconnect frees it. When you are at the limit the connect
button returns 402 PLAN_LIMIT_EXCEEDED with your current count.
How connecting works
Section titled “How connecting works”- Open Settings → Connectors. The Available Connectors grid lists every connector you have not connected yet; click the + button on the one you want.
- A Connect Service dialog opens.
- Credential connectors (Stripe, Mailchimp, WordPress, LinkedIn, X, Meta, Facebook, Instagram, Generic CRM) ask for the secret and any destination IDs, then Verify and connect calls the provider to validate the credential before anything is saved. A failed verification saves nothing.
- OAuth connectors (QuickBooks, Shopify, HubSpot, Google Analytics,
Xero) ask only for destination IDs where the provider does not return
them (Shopify shop host, GA4 property ID), then Authorize account
opens the provider’s consent screen in a popup. If your browser blocks
it, allow popups for
ultimateteam.aiand click again. The OAuth state token is single-use and expires after 10 minutes; the callback re-checks that the signed-in owner is still an active member before exchanging the code.
- The connector appears under Connected with its health status. The
platform publishes
connector.authorizedso agents learn about the new tool immediately. - Open Settings → Connectors → Connector Permissions to tighten the policy that was created from your plan defaults (below).
Connecting requires an owner session with the system:edit permission; API
keys cannot start an OAuth flow. Credentials are encrypted with a per-tenant
KMS key and stored in Secret Manager. They are referenced by ID from the
connector record and never returned to the browser or cached in Redis.
Permission model
Section titled “Permission model”Every connector instance gets its own policy, seeded from your plan when you connect. The Permission Enforcer checks the policy before every tool call; a tool call that is not allowed fails closed — there is no silent fallback.
| Setting | Starter | Professional | Business | Enterprise |
|---|---|---|---|---|
| Read | Yes | Yes | Yes | Yes |
| Create | Yes | Yes | Yes | Yes |
| Update | No (cannot be enabled) | Yes | Yes | Yes |
| Delete | No (cannot be enabled) | No | Yes, with approval | Yes |
| Send / publish | With approval | Yes | Yes | Yes |
| Export | No (cannot be enabled) | Yes | Yes | Yes |
| Spending per txn / day / month | $100 / $500 / $5,000 | $500 / $2,500 / $25,000 | $2,500 / $10,000 / $100,000 | Configurable |
| Rate limit (per minute / hour) | 10 / 100 | 30 / 500 | 60 / 1,000 | 120 / 5,000 |
| Audit level | Summary | Full | Full | Full |
The policy also carries a data read scope (entity types, excluded fields,
date range, filters) and an approval list of actions that always route to
your approval queue. You can tighten any value; you cannot exceed your plan’s
maximums. Saves are written to the immutable audit chain with the before/after
policy and publish security.connector_permissions_updated.
Each tool maps to one action: read tools use read; drafting/staging tools
use create; publishing tools use send or update; deletion tools use
delete. The per-connector guides call out which of their tools are writes.
Disconnecting
Section titled “Disconnecting”Under Connected, click the trash icon next to a connector and confirm
Disconnect. The platform marks the instance disconnected, writes a
connector.disconnected audit entry, revokes the stored credential from the
vault, and clears the credential reference. Agents lose the connector’s tools
immediately and the integration slot is freed. Revoking the app on the
provider side (for example removing the app in your QuickBooks or HubSpot
account) also stops access, but does not free the slot until you disconnect
here. Use Reconnect on the same row to re-authorize a connector whose
token expired without losing its permission policy.