External Integrations

Slack

Slack installs should go through the Clips Settings OAuth flow (connect-slack, /api/slack/oauth/callback) so each Slack workspace gets its own encrypted bot token in app_secrets. SLACK_BOT_TOKEN is only a legacy single-workspace fallback and must remain behind the team allowlist.

Link previews are handled by the unfurl webhook; see the video-sharing skill for the /api/slack/unfurl contract, the required scopes and events, and which clips may produce a playable video block.

Atlassian / Jira

Atlassian/Jira is available through the shared MCP integration catalog. It uses Atlassian Rovo MCP OAuth. Explain that an Atlassian organization admin may need to allow the Clips app domain and enable the required Read, Write, and Search permissions before the connection can complete.

Provider API boundary

Credentialed provider integrations normally belong on the shared provider API substrate (provider-api-catalog, provider-api-docs, provider-api-request). Clips has one deliberate exception: Google Calendar. Calendar grants live in Clips calendar_accounts with encrypted app_secrets token refs rather than core oauth_tokens, so raw provider requests would bypass the account sharing/status boundary. See the meetings skill before touching that path.

Related skills

• video-sharing — Slack unfurl route, scopes, and playable-clip rules.
• meetings — Google Calendar connection model and why raw provider requests are not wired up yet.
• security — encrypted per-workspace credential storage in app_secrets.