Croft connectors: Xero, Stripe, Slack, Linear and more, with the keys held by Croft and never in an app's code.

Blog · October 26, 2026 · Rich Chetwynd

Croft connectors: Xero, Stripe, Slack, Linear and more for your AI-built apps

A guide to Croft connectors for AI-built apps: how they work, which finance, email, forms, scheduling and project tools you can connect, and how Croft holds the credentials so your apps never do.

Quick answer

A Croft connector lets the apps you build with an AI assistant use an outside tool, such as Xero, Stripe, Slack, Linear, Brevo or Jotform, without the credential ever sitting in the app’s code. You paste a key or sign in once. Croft keeps the credential encrypted, and your apps call the tool through Croft’s gateway. The full catalogue is on the connectors page; this guide explains how connectors work and which ones fit which job.

How Croft connectors work

When an AI assistant builds an app that needs an outside service, the easy path is to paste the API key into the code. That works until the app is shared, copied or leaked, and then the key goes with it.

Croft does it differently:

  1. You connect the tool once. Sign in or paste your own key in Croft. You can ask your assistant to do it, for example “connect our Stripe account.”
  2. Croft holds the credential. It is stored encrypted and never shown to an app or written into generated code.
  3. Apps ask through a gateway. An app does not call the tool directly. It asks Croft, which checks the app is allowed, adds the key on the way out and hands back only the result.
  4. One connection, many apps. Every app you allow can use the same connector. Change the key in one place and everything keeps working.

Some connectors, such as Xero and Google Search Console, are also kept in sync: Croft keeps a curated copy of the data on your own server so your AI can query it. How synced data works covers that side. The rest of this guide is about the apps you build.

You bring your own AI assistant and your own accounts with each tool. Croft holds the connection, not the subscription.

Finance and accounting

Finance is where leaking a key hurts most, so it is the clearest case for keeping credentials out of app code.

Email and messaging

Most internal apps end up needing to tell someone something. The email connectors let an app send mail without carrying a sending key:

  • SendGrid, Postmark, Mailgun and Resend for transactional email such as approval requests, receipts and weekly reports.
  • Brevo for email plus contact and list management, for example adding a contact to a sequence when a demo request form comes in.
  • Loops, ConvertKit and beehiiv for lifecycle email and newsletters.
  • Slack for posting messages and reading channels. A common pattern is an approval app that posts a request to a channel and updates the thread when someone decides.

If you are picking one, the apps work the same way from your side. Choose the provider you already pay for. The step-by-step version for email is in how to send email from an AI-built app.

Forms, scheduling and project tools

Many small teams already collect work in forms and calendars and track it in a project tool. Connectors let a Croft app sit on top of those:

There are also connectors for CRM (HubSpot, Pipedrive, Attio), GitHub, and AI model providers such as OpenAI and Anthropic, so an app can call a model without a model key in its code.

Credentials and admin governance

Holding the key is the first half. The second half is deciding who gets to use it.

  • The key stays with Croft. It is encrypted, never shown to an app, and not written into the code your assistant generates. A leaky app cannot spill a key it never had.
  • Sensitive connectors can need approval. Mark a connector, such as payroll or your customer database, as needing an admin’s approval. Anyone can build an app that asks to use it, but it stays off until an admin says yes.
  • Approve narrowly. Approve a connector for a specific app or person, not the whole company.
  • There is a record. Connectors, approvals and use are logged, so “who can reach our billing data?” has an answer.

Roles still apply on top. See roles and permissions and the security overview. For the technical detail, including how requests are made, read the connectors docs.

Request a connector

If the tool you need is not in the catalogue, you have two options:

  • Use the custom connector. It lets apps call any HTTP API through Croft’s gateway. You set the base URL and auth method once and the credentials stay with Croft. This is how you would reach an internal system, a niche SaaS tool or a legacy API. See the custom connector.
  • Ask for a dedicated one. Email [email protected] with the tool’s name and what you want to build. Please do not send keys or passwords. More on support.

FAQ

What is a connector on Croft?

A connector lets an app use an outside tool such as Xero, Stripe, Slack or Linear, with the credential held by Croft and never written into the app’s code.

Does my AI-built app hold my API keys?

No. The app asks Croft to make the call. Croft checks the app is allowed, adds the key on the way out and returns the result.

Can I connect a tool that is not in the list?

Yes, with the custom connector, or by emailing us to request a dedicated one.

Can I restrict who can use a connector?

Yes. Sensitive connectors can require an admin’s approval for a specific app or person, and use is logged.

Do I need my own account with each tool?

Yes. You sign in or paste your own key for each tool, and Croft holds it. See pricing for current Croft plans.

Browse all connectors →  ·  Start free trial →  ·  Connectors docs →

More from the blog

Start your free trial.

Your team's first app could be live before lunch.

No card. 7 days. Cancel anytime.