sync: add Apollo (API Key), Momentum, and Zoom Revenue Accelerator connectors - #891
sync: add Apollo (API Key), Momentum, and Zoom Revenue Accelerator connectors#891Pranesh-Raghu wants to merge 10 commits into
Conversation
Reconciled docs catalog against Scalekit prod (328 providers, matching the dashboard count exactly). Adds: - Apollo (API Key) — 75 tools - Momentum — 8 tools - Stripe — 111 tools - Zoom Revenue Accelerator — 44 tools
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAmplitude Analytics, Apollo API Key, Momentum, Stripe, and Zoom Revenue Accelerator connectors were added with tool catalogs, indexed definitions, metadata, setup guidance, and documentation. Discord and Discord Bot tooling and documentation were expanded. ChangesConnector registration and shared setup
Amplitude Analytics connector
Discord connectors
Apollo API Key connector
Momentum connector
Stripe connector
Zoom Revenue Accelerator connector
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@public/data/agent-tools-index.json`:
- Around line 51122-51125: Remove the entire stripe_zz_test_echo_probe_dahlia
entry from the production tool index, including its slug, name, description, and
surrounding object syntax. Preserve all other Stripe tool entries and ensure the
index reflects the intended production tool count of 110.
In `@src/data/agent-connectors/stripe.ts`:
- Around line 3462-3473: Remove the temporary tool definition identified by the
name stripe_zz_test_echo_probe_dahlia from the Stripe connector metadata,
including its parameters and description, then re-sync the upstream connector
catalog so the test-only echo probe is no longer exposed as a callable Stripe
tool.
In `@src/data/agent-connectors/tools-index.json`:
- Around line 51122-51126: Remove the temporary tool definition for
stripe_zz_test_echo_probe_dahlia from the Stripe connector catalog, then rerun
the connector index synchronization so the generated tools-index.json no longer
contains this entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: dc897668-9139-40ee-8c7b-f29710409d99
📒 Files selected for processing (11)
public/data/agent-tools-index.jsonsrc/content/docs/agentkit/connectors/apolloapikey.mdxsrc/content/docs/agentkit/connectors/momentum.mdxsrc/content/docs/agentkit/connectors/stripe.mdxsrc/content/docs/agentkit/connectors/zoomrevenueaccelerator.mdxsrc/data/agent-connectors/apolloapikey.tssrc/data/agent-connectors/catalog.tssrc/data/agent-connectors/momentum.tssrc/data/agent-connectors/stripe.tssrc/data/agent-connectors/tools-index.jsonsrc/data/agent-connectors/zoomrevenueaccelerator.ts
👷 Deploy Preview for scalekit-starlight processing.
|
- Discord Bot (new) — 205 tools - Discord — 16 -> 34 tools
- discord: document the bot scope, Bot Permissions bitfield, guild_id, disable_guild_select, and integration_type fields with a screenshot of Discord's permissions calculator - discordbot: add full Bot Token setup guide (create app, get bot token, invite to server, add connected account)
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/components/templates/agent-connectors/_setup-discord.mdx`:
- Line 68: Update the Bot Permissions guidance in the Discord setup template to
remove the unsafe default bitfield 2260657982483703. Instruct users to select
only the minimum permissions required by the bot, and replace the generic
applications link with the Discord permissions UI link.
In `@src/components/templates/agent-connectors/_setup-discordbot.mdx`:
- Around line 51-65: Add inline security guidance to both TypeScript and Python
upsert_connected_account examples: read the Discord bot token from secure
storage or an environment variable instead of hardcoding it, and include
language-appropriate comments warning against committing the secret to source
control or exposing it in logs.
- Around line 51-65: Add the required SDK imports and client initialization to
the TypeScript and Python snippets before their upsertConnectedAccount calls,
using the existing Scalekit setup conventions. Ensure both complete examples are
directly runnable, or explicitly label them as excerpts if setup cannot be
included.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: a7c225be-de23-446b-ba46-1929baf24500
⛔ Files ignored due to path filters (2)
src/assets/docs/agent-connectors/discord/bot-permissions.pngis excluded by!**/*.pngsrc/assets/docs/agent-connectors/discordbot/bot-tab.pngis excluded by!**/*.png
📒 Files selected for processing (4)
src/components/templates/agent-connectors/_setup-discord.mdxsrc/components/templates/agent-connectors/_setup-discordbot.mdxsrc/components/templates/agent-connectors/index.tssrc/content/docs/agentkit/connectors/discordbot.mdx
| If your agent needs to act as a bot in a server — sending messages, managing channels, or reacting to events — include the `bot` scope when you request authorization. Discord then asks the installing user to also grant a set of **bot permissions**. | ||
|
|
||
| - In the Scalekit connection settings, set: | ||
| - **Bot Permissions** — a bitfield describing what your bot can do in the server. Use the [permissions calculator](https://discord.com/developers/applications) on your application's **Bot** page to generate this value, or use the recommended default `2260657982483703` for common read/write access. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,140p' src/components/templates/agent-connectors/_setup-discord.mdxRepository: scalekit-inc/developer-docs
Length of output: 4732
🌐 Web query:
Discord bot permissions bitfield 2260657982483703 invite kick ban permissions recommended default
💡 Result:
The Discord permission bitfield 2260657982483703 is an integer that encodes a specific set of permissions for a bot or user [1][2][3]. Discord permissions are stored as a 64-bit integer where each bit represents a unique privilege [4][3][5]. To determine exactly which permissions are enabled for this specific bitfield, you can use a Discord permission calculator or a programming environment (such as JavaScript or Python) to perform a bitwise AND operation against the defined permission flags [6][7][5][8]. To check if a specific permission is included in 2260657982483703, you can use the following logic in many programming languages [6]: const bitfield = 2260657982483703n; const KICK_MEMBERS = 1n << 1n; // 2 const BAN_MEMBERS = 1n << 2n; // 4 const CREATE_INVITE = 1n << 0n; // 1 // Check for a permission const hasKick = (bitfield & KICK_MEMBERS) === KICK_MEMBERS; For practical purposes, you can copy the number 2260657982483703 and paste it into various community-provided Discord permission calculators (such as those found at discordapi.com, gatecord.com, or xgamingserver.com) to see a human-readable list of all checked permissions [7][3][5]. These tools automatically decode the bitfield by identifying which bits are set to 1 [5][9][8]. Regarding recommended default permissions: Discord does not have a single fixed set of recommended default permissions; you should only request the permissions your bot specifically requires to function [5][8]. For example, if your bot only needs to respond to slash commands, it may only need the Use Application Commands permission [4][5]. Requesting unnecessary permissions, especially sensitive ones like Administrator, Kick Members, or Ban Members, is generally discouraged for bot security and user trust [5][10]. Always review the official Discord API documentation for the specific requirements of your bot's features [6][1].
Citations:
- 1: https://docs.discord.com/developers/topics/permissions
- 2: https://giga.tools/discord/permission-calculator
- 3: https://gatecord.com/discord-permission-calculator/
- 4: https://discord.js.org/docs/packages/discord-api-types/main/PermissionFlagsBits:Variable
- 5: https://xgamingserver.com/tools/discord-bot/permissions
- 6: https://github.com/discord/discord-api-docs/blob/e3770eb5/developers/topics/permissions.mdx
- 7: https://discordapi.com/permissions.html
- 8: https://www.scoplidrop.com/tools/discord-permissions-calculator
- 9: https://discordgate.com/tools/permissions-calculator
- 10: https://siennanation.com/permissions
🏁 Script executed:
python3 - <<'PY'
value = 2260657982483703
for bit, name in [(0,'CREATE_INSTANT_INVITE'), (1,'KICK_MEMBERS'), (2,'BAN_MEMBERS')]:
print(name, bool(value & (1 << bit)))
print("low bits", bin(value & 0b111))
PYRepository: scalekit-inc/developer-docs
Length of output: 242
🌐 Web query:
site:docs.discord.com developers topics permissions Discord bot permissions calculator bot page permissions
💡 Result:
Discord bot permissions determine what actions an application can perform within a server or channel [1][2]. These permissions are managed via a bitfield system and are essential for controlling bot functionality and security [1][3]. Core Concepts: Permissions Bitfield: Discord stores permissions as a variable-length integer [3]. Each permission corresponds to a specific bit in this integer [3]. To determine the total permissions value, you use bitwise OR (|) operations on the individual flag values [3]. To check if a bot has a specific permission, you use a bitwise AND (&) operation [3]. Guild-level vs. Channel-level: Permissions can be configured at the guild (server) level, which applies generally, or overridden at the channel level for specific roles or members [3][2]. OAuth2 and Authorization: When adding a bot to a server, you use an OAuth2 URL that includes the bot scope and a permissions integer [1][4]. This integer dictates the permissions the bot requests from the server administrator [1][5]. Managing Permissions: Developer Portal: When configuring your application in the Discord Developer Portal, you can select the required permissions under the Bot tab [6][5]. This ensures the correct permissions bitfield is included when users invite your bot [4]. Permission Overwrites: These allow you to adjust access on a per-channel basis [3][2]. For example, you might grant a bot the ability to send messages server-wide, but deny it that permission in a specific private channel [2]. Application Command Permissions: Distinct from standard bot permissions, these allow you to enable or disable specific slash commands for particular roles, users, or channels [3][7]. Best Practices: Request Minimal Permissions: Always follow the principle of least privilege [1]. Only request the permissions your bot absolutely needs to function [1]. Requesting excessive permissions can reduce user trust and may violate developer policies [1]. Use Big Integer Libraries: Because permissions are stored as large, variable-length integers, it is recommended to use your programming language's built-in Big Integer libraries for handling these values to ensure stability [3]. You can find the complete, up-to-date reference table of all permission flags, their hexadecimal integer values, and usage requirements in the official Discord documentation [3].
Citations:
- 1: https://docs.discord.com/developers/platform/oauth2-and-permissions
- 2: https://docs.discord.com/developers/platform/server-and-channel-management
- 3: https://docs.discord.com/developers/topics/permissions
- 4: https://docs.discord.com/developers/topics/oauth2
- 5: https://docs.discord.com/developers/quick-start/getting-started
- 6: https://docs.discord.com/developers/bots/overview
- 7: https://docs.discord.com/developers/interactions/application-commands
Remove the default bot-permissions bitfield
2260657982483703 includes invite, kick, and ban permissions, so it is not a safe generic read/write preset. Use the minimum bitfield the bot needs, and link to the Discord permissions UI instead of the generic applications page.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/templates/agent-connectors/_setup-discord.mdx` at line 68,
Update the Bot Permissions guidance in the Discord setup template to remove the
unsafe default bitfield 2260657982483703. Instruct users to select only the
minimum permissions required by the bot, and replace the generic applications
link with the Discord permissions UI link.
Source: MCP tools
| ```ts | ||
| await scalekit.connect.upsertConnectedAccount({ | ||
| connectionName: 'discordbot', | ||
| identifier: 'user@example.com', | ||
| credentials: { apiKey: 'your-discord-bot-token' }, | ||
| }) | ||
| ``` | ||
| </TabItem> | ||
| <TabItem label="Python"> | ||
| ```python | ||
| scalekit_client.connect.upsert_connected_account( | ||
| connection_name="discordbot", | ||
| identifier="user@example.com", | ||
| credentials={"api_key": "your-discord-bot-token"}, | ||
| ) |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Add inline secret-handling guidance.
These examples pass a bot token without an inline warning to keep it out of source control and logs. Add language-appropriate security comments and show the value coming from secure storage.
As per path instructions, security-sensitive code examples must include inline comments explaining the mitigated threat.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/templates/agent-connectors/_setup-discordbot.mdx` around lines
51 - 65, Add inline security guidance to both TypeScript and Python
upsert_connected_account examples: read the Discord bot token from secure
storage or an environment variable instead of hardcoding it, and include
language-appropriate comments warning against committing the secret to source
control or exposing it in logs.
Source: Path instructions
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,140p' src/components/templates/agent-connectors/_setup-discordbot.mdx | cat -nRepository: scalekit-inc/developer-docs
Length of output: 3715
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
p = Path('src/components/templates/agent-connectors/_setup-discordbot.mdx')
for i, line in enumerate(p.read_text().splitlines(), 1):
if 1 <= i <= 140:
print(f"{i:4}: {line}")
PYRepository: scalekit-inc/developer-docs
Length of output: 3645
🏁 Script executed:
ls -la src/components/templates/agent-connectors && echo '---' && sed -n '1,120p' src/components/templates/agent-connectors/_setup-discordbot.mdx | nl -ba | sed -n '1,120p'Repository: scalekit-inc/developer-docs
Length of output: 21302
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
import re
root = Path('src/components/templates/agent-connectors')
patterns = [
('upsertConnectedAccount', re.compile(r'upsertConnectedAccount|upsert_connected_account')),
('import', re.compile(r'^\s*import\s+', re.M)),
('constructor', re.compile(r'new\s+Scalekit|Scalekit\(')),
]
for path in sorted(root.glob('_setup-*.mdx')):
text = path.read_text()
if patterns[0][1].search(text):
print(f'FILE: {path}')
for name, pat in patterns:
print(f' {name}:', bool(pat.search(text)))
print(' --- snippets ---')
for m in re.finditer(r'```(?:ts|js|python|go|java)\n(.*?)```', text, re.S):
snippet = m.group(1).strip().splitlines()[:8]
print(' ', ' / '.join(snippet))
print()
PYRepository: scalekit-inc/developer-docs
Length of output: 13611
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
import re
root = Path('src/components/templates/agent-connectors')
for path in sorted(root.glob('_setup-*.mdx')):
text = path.read_text()
if 'upsertConnectedAccount' in text or 'upsert_connected_account' in text:
print(f'FILE: {path}')
for label, needle in [
('has import', 'import '),
('has scalekit client init', 'new Scalekit'),
('has scalekit_client init', 'scalekit_client ='),
('has upsertConnectedAccount', 'upsertConnectedAccount'),
('has upsert_connected_account', 'upsert_connected_account'),
]:
print(f' {label}: {needle in text}')
print()
PYRepository: scalekit-inc/developer-docs
Length of output: 6788
Make these SDK snippets runnable. scalekit and scalekit_client appear without the import and client setup needed to call upsertConnectedAccount, so copying either block fails before the connected account is created. Add the initialization or mark them as excerpts.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/templates/agent-connectors/_setup-discordbot.mdx` around lines
51 - 65, Add the required SDK imports and client initialization to the
TypeScript and Python snippets before their upsertConnectedAccount calls, using
the existing Scalekit setup conventions. Ensure both complete examples are
directly runnable, or explicitly label them as excerpts if setup cannot be
included.
Source: Path instructions
58 tools, HTTP Basic Auth (API Key + Secret Key). Covers finding your data residency region, generating keys, and running both US and EU connected accounts side by side via the domain credential field.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@public/data/agent-tools-index.json`:
- Around line 2967-3257: Descriptions in the generated amplitudeanalytics tool
index are being truncated mid-sentence, removing critical caveats and credential
guidance. Update the index-generation pipeline responsible for producing tool
descriptions so the length limit is increased sufficiently or truncation occurs
only at a complete sentence; preserve the full warnings for tools such as
amplitudeanalytics_update_annotation, amplitudeanalytics_update_user_property,
and DSAR-related tools, then regenerate the index instead of editing the
generated JSON directly.
In `@src/components/templates/agent-connectors/_setup-amplitudeanalytics.mdx`:
- Around line 21-31: Update the “Get your Secret Key” step to instruct users to
generate a new Secret Key and copy it immediately, rather than clicking “Show”
for an existing key. Also revise the Amplitude settings navigation in the
API-key step to match the current key-management UI, while keeping the
surrounding screenshots and sequence intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5049fa97-667e-4a54-86d4-bccdfca457c9
⛔ Files ignored due to path filters (2)
src/assets/docs/agent-connectors/amplitudeanalytics/api-keys.pngis excluded by!**/*.pngsrc/assets/docs/agent-connectors/amplitudeanalytics/secret-keys.pngis excluded by!**/*.png
📒 Files selected for processing (7)
public/data/agent-tools-index.jsonsrc/components/templates/agent-connectors/_setup-amplitudeanalytics.mdxsrc/components/templates/agent-connectors/index.tssrc/content/docs/agentkit/connectors/amplitudeanalytics.mdxsrc/data/agent-connectors/amplitudeanalytics.tssrc/data/agent-connectors/catalog.tssrc/data/agent-connectors/tools-index.json
| - Sign in to Amplitude and go to **Settings** → **Agent Connectors** (or **API and Secret Keys**) → **API Keys**. | ||
| - Click **Generate API Key**, or copy an existing key's value. | ||
|
|
||
|  | ||
|
|
||
| 3. ### Get your Secret Key | ||
|
|
||
| - Click the **Secret Keys** tab. | ||
| - Click **Show** next to the secret key that matches the API key you copied in step 2, and copy it. | ||
|
|
||
|  |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
file='src/components/templates/agent-connectors/_setup-amplitudeanalytics.mdx'
wc -l "$file"
sed -n '1,120p' "$file" | cat -nRepository: scalekit-inc/developer-docs
Length of output: 5998
🌐 Web query:
Amplitude Secret Keys cannot be revealed again API keys docs
💡 Result:
Yes, that is correct. According to Amplitude documentation, when you generate a secret key, Amplitude displays it only once [1]. Once you navigate away or close the dialog, it cannot be revealed again [1]. If you lose or forget a secret key, you cannot retrieve the original value [1]. Because secret keys are sensitive credentials used for server-side API authentication, Amplitude recommends that you delete the compromised or forgotten key and generate a new one [2]. For project management: - You can manage keys via the project settings (Settings > Projects) [1][3]. - Managers and Admins have the authority to generate and revoke these keys [4][1]. - While API keys are generally used for event ingestion and may be visible to authorized users, secret keys must be kept private and handled securely in server-side environments [2][5]. If a key is lost, the standard procedure is to generate a replacement and update your server-side configurations [2].
Citations:
- 1: https://amplitude.com/docs/apis/authentication
- 2: https://amplitude.com/docs/apis/keys-and-tokens
- 3: https://amplitude.com/docs/admin/account-management/manage-orgs-projects
- 4: https://amplitude.com/docs/admin/account-management/manage-your-api-keys-and-secret-keys
- 5: https://www.rapidevelopers.com/flutterflow-integrations/amplitude
Fix the Amplitude secret-key step
Amplitude only shows a Secret Key when it’s generated; it can’t be revealed later. Replace the Show instruction with “generate a new Secret Key and copy it immediately,” and update the settings path to match Amplitude’s key-management UI.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/components/templates/agent-connectors/_setup-amplitudeanalytics.mdx`
around lines 21 - 31, Update the “Get your Secret Key” step to instruct users to
generate a new Secret Key and copy it immediately, rather than clicking “Show”
for an existing key. Also revise the Amplitude settings navigation in the
API-key step to match the current key-management UI, while keeping the
surrounding screenshots and sequence intact.
amplitude.svg (lowercase) 404s on the CDN; Amplitude.svg is the actual asset.
…ng, remove test tool - Amplitude Experiment Management (new, 57 tools, Bearer token) with a setup guide covering both US and EU data residency regions - Revert amplitudeanalytics icon back to lowercase amplitude.svg to match the provider's actual icon_src (both casings happened to resolve on the CDN, but lowercase is the source of truth) - Remove stripe_zz_test_echo_probe_dahlia — a test-only tool that forwards Stripe Bearer tokens to postman-echo.com, flagged by CodeRabbit as a credential-leak risk
- Mixpanel Analytics — 37 tools (Service Account / legacy Project Secret) - Mixpanel Compliance — 5 tools (GDPR/CCPA compliance token) - Mixpanel Ingestion — 25 tools (Service Account / legacy Project Secret) Catalog count matches prod exactly (334). Stripe's docs=110 vs prod=111 tool-count check is a false positive: prod still includes the flagged stripe_zz_test_echo_probe_dahlia test tool, correctly excluded from docs.
Pranesh-Raghu
changed the title
3 participants
Summary
Discord, Amplitude, Mixpanel, and Stripe connectors that were originally bundled into this branch have been split out into PR #910, which has already merged into main.
Preview
https://deploy-preview-891--scalekit-starlight.netlify.app/agentkit/connectors/apolloapikey/