Integration catalog

Every integration is declared by one Integration Manifest and served through the registry read (GET /v1/organizations/{orgId}/integrations/registry). The hub, each integration's page, the Secrets surface, and the orun CLI all derive from the same descriptors — this catalog is generated from them.

Integration	Category	Connect	Capabilities	Status
GitHub	Source control	app install	connect, inbound, scm	Available
Slack	Messaging	OAuth	connect, inbound, messaging	Available
Cloudflare	Infrastructure	OAuth · token paste	connect, credential-broker, secrets	Available
Supabase	Infrastructure	OAuth · token paste	connect, credential-broker, secrets	Available
Linear	tracker	OAuth	connect, inbound	Available
Anthropic	AI providers	API key	connect	Available
OpenAI	AI providers	API key	connect	Available
OpenRouter	AI providers	API key	connect	Available
Daytona	Compute	API key	connect	Available
AWS	Infrastructure	token paste	connect, credential-broker, secrets	On the roadmap
Azure	Infrastructure	OAuth · token paste	connect, credential-broker, secrets	Available
Coolify	Infrastructure	token paste	connect, credential-broker, secrets	Available
Discord	Messaging	OAuth	connect, messaging	On the roadmap

GitHub

Install the GitHub App: repo links, scm.* events, scoped tokens.

• Category: Source control · Status: Available · Manifest: v1
• Connect: app install
• Capabilities: connect, inbound, scm
• Entitlement: feature.integrations.github

Slack

Connect a workspace: channel delivery, /orun, actionable alerts.

• Category: Messaging · Status: Available · Manifest: v1
• Connect: OAuth
• Capabilities: connect, inbound, messaging
• Entitlement: feature.integrations.slack

Cloudflare

Connect accounts; mint short-lived scoped tokens, never paste keys.

• Category: Infrastructure · Status: Available · Manifest: v1
• Connect: OAuth · token paste — multiple connections supported
• Capabilities: connect, credential-broker, secrets
• Entitlement: feature.integrations.cloudflare

Cloudflare token paste recipe

Create an Account API token (recommended — owned by the account, not a person; a user token with account scope also works) with these permissions. Templates you skip can be left off:

• Account API Tokens Write — mint and revoke the short-lived child tokens
• Workers Scripts Write — Deploy Workers template
• Workers KV Storage Write — Deploy Workers template
• Account Settings Read — Deploy Workers, Deploy Pages, Account read, Edit Hyperdrive, Edit D1 templates
• Pages Write — Deploy Pages template
• DNS Write — Edit DNS template
• Workers R2 Storage Write — R2 data access template
• Hyperdrive Write — Edit Hyperdrive template
• D1 Write — Edit D1 template

Supabase

Connect an org: short-lived Management API access per run.

• Category: Infrastructure · Status: Available · Manifest: v2
• Connect: OAuth · token paste
• Capabilities: connect, credential-broker, secrets
• Entitlement: feature.integrations.supabase

Supabase token paste recipe

Create a personal access token in your Supabase account (Account → Access Tokens). PATs cannot be narrowed provider-side — the token carries your full account access, so the platform envelopes it once, narrows every issuance to a template, and ledgers each one.

• Management API access — backs the management-access template (TTL-bounded, ledgered per issuance).
• Run database migrations — backs the db-migrate template (TTL-bounded, ledgered per issuance).
• Deploy Edge Functions — backs the functions-deploy template (TTL-bounded, ledgered per issuance).
• Project service-role key — backs the project-service-key template (TTL-bounded, ledgered per issuance).
• Organization ID — backs the org-id template (TTL-bounded, ledgered per issuance).

Linear

Connect a workspace: issues mirror onto tasks, evidence beside status.

• Category: tracker · Status: Available · Manifest: v1
• Connect: OAuth
• Capabilities: connect, inbound
• Entitlement: feature.integrations.linear

Anthropic

Bring your Anthropic key: models for agent sessions and dispatch.

• Category: AI providers · Status: Available · Manifest: v1
• Connect: API key — multiple connections supported
• Capabilities: connect
• Entitlement: feature.integrations.anthropic

OpenAI

Bring your OpenAI key: models for agent sessions and dispatch.

• Category: AI providers · Status: Available · Manifest: v1
• Connect: API key — multiple connections supported
• Capabilities: connect
• Entitlement: feature.integrations.openai

OpenRouter

Bring your OpenRouter key: one credential, many models.

• Category: AI providers · Status: Available · Manifest: v1
• Connect: API key — multiple connections supported
• Capabilities: connect
• Entitlement: feature.integrations.openrouter

Daytona

Bring your Daytona account: sandbox compute for agent sessions.

• Category: Compute · Status: Available · Manifest: v1
• Connect: API key — multiple connections supported
• Capabilities: connect
• Entitlement: feature.integrations.daytona

AWS

Short-lived STS credentials per run — on the roadmap.

• Category: Infrastructure · Status: On the roadmap · Manifest: v2
• Connect: token paste — multiple connections supported
• Capabilities: connect, credential-broker, secrets
• Entitlement: feature.integrations.aws

Azure

Connect a subscription: short-lived, role-scoped ARM tokens per run — then deploys federate directly.

• Category: Infrastructure · Status: Available · Manifest: v2
• Connect: OAuth · token paste — multiple connections supported
• Capabilities: connect, credential-broker, secrets
• Entitlement: feature.integrations.azure

Azure token paste recipe

Create a service principal scoped to the subscription you want to deploy into, then paste the command's JSON output. Run: az ad sp create-for-rbac --name orun --role Contributor --scopes /subscriptions/<subscription-id> --sdk-auth. The platform envelopes the output once and never reads it back; every issuance from it is narrowed to a template, TTL-bounded, and ledgered.

• Bootstrap provisioning — backs the bootstrap-provisioning template (TTL-bounded, ledgered per issuance).
• Read-only inspection — backs the readonly-inspection template (TTL-bounded, ledgered per issuance).

Coolify

Connect a self-hosted or Cloud instance: ledgered, TTL-bounded deploys against your own container platform.

• Category: Infrastructure · Status: Available · Manifest: v2
• Connect: token paste — multiple connections supported
• Capabilities: connect, credential-broker, secrets
• Entitlement: feature.integrations.coolify

Coolify token paste recipe

In Coolify, open Keys & Tokens → API tokens and create one with the deploy and write abilities. Not root — it bypasses every permission check and is more than the platform needs. Coolify shows the token once. The platform envelopes it and never reads it back; every issuance is TTL-bounded and ledgered.

• Deploy an application — backs the deploy-application template (TTL-bounded, ledgered per issuance).
• Manage projects and applications — backs the manage-resources template (TTL-bounded, ledgered per issuance).
• Instance URL — backs the instance-url template (TTL-bounded, ledgered per issuance).

Discord

Channel delivery for Discord servers — on the roadmap.

• Category: Messaging · Status: On the roadmap · Manifest: v1
• Connect: OAuth
• Capabilities: connect, messaging
• Entitlement: feature.integrations.discord