Telemetry vs. providers
Two kinds of connection land on the same surface. Telemetry sources issue an ingest key your app presents (the generic OTel SDK lane). Providers also pull or receive cost and usage on your behalf — some over OAuth, some by pasting a token or access key. What you see on a provider afterward is a live per-signal status derived from your telemetry, not a static checkbox.
Providers
| Provider | Connect via | Capabilities |
|---|---|---|
| Anthropic | Token paste (telemetry key and/or Admin key) | Telemetry (gen_ai traces), cost (Admin Cost Report) |
| Vercel | Token paste | Telemetry (log & trace drains), cost (FOCUS billing) |
| DigitalOcean | OAuth | Cost (billing insights & invoices), infra metrics |
| AWS | Access-key paste (Cost Explorer) | Cost (daily, by service) |
| Slack | OAuth | Incident notifications, interactive Ack/Resolve, the agent DM |
How a connection is kept
Provider credentials sit AES-encrypted on the integration record and are never serialized back to you. When a credential goes stale — a rotated key, a revoked grant — the integration surfaces reconnect_required instead of failing silently, and you fix it by reconnecting through the same setup flow. A transient network blip does not flip that state; only a provider actually rejecting the credential does.
Cost is billed-first
Every provider that reports money writes into the FOCUS-shaped cost ledger: DigitalOcean, Vercel, AWS, and Anthropic all upsert nightly figures that restate in place as invoices finalize. That is what lets the console show real billed dollars, broken down by provider and service, rather than a price-list guess.
Removing an integration
Disconnecting in byteshift is deliberately local: it stops reading and drops the stored credential, but it does not reach into the provider to tear down drains or revoke keys still valid on their side. Those remain yours to retire, and the setup copy says so.