Wire in Stripe, Resend, and 13 more in one click

The slowest part of a new app is rarely the idea. It’s wiring: API keys, a client, a webhook handler, the boilerplate route you’ve written a hundred times. The integration marketplace removes that step entirely.

Connect a service, Stripe, Resend, OpenAI, Anthropic, Sentry, PostHog, Slack, Notion, and more, and Moonshift stores your credentials encrypted at rest. From then on, every app it builds gets those keys, a typed client, and ready-to-use routes wired in deterministically.

Paste a key or sign in

Twelve integrations take a pasted key. Three, Slack, Notion, and Google, use a proper OAuth flow with CSRF protection and short-lived tokens. Either way, the connection lives in your account, not buried in a generated file you’d have to find and rotate by hand.

• Payments: Stripe checkout, webhooks, and a typed client.
• Email: Resend send routes with your domain.
• AI: OpenAI and Anthropic clients, keys already in the env.
• Observability: Sentry and PostHog wired at build time.
• Workflow: Slack and Notion via OAuth, tokens short-lived.

How injection actually works

Enabled integrations are injected into every spawned run’s environment, so the generated code can assume the credentials exist. The build agents emit the client and the routes against that known env. There’s no “add your key here” placeholder left for you to fill in later, the wiring is part of the build, not a homework assignment.

That determinism is the whole point: the same prompt produces the same wired result, every time. An integration isn’t a stub you finish; it’s a capability the build can rely on.

It shows up in the build, not a to-do list

Ask for “a storefront that charges with Stripe and emails receipts with Resend,” and the build comes back with checkout, webhooks, and a send route already working against your accounts. You describe the outcome; the integration is just there.

Where the credentials live

Keys are encrypted at rest and scoped to your account. OAuth connections use short-lived tokens and a CSRF-protected callback, so a connect link can’t be replayed against your account. The connection is something you manage in one place and revoke in one place, not something scattered across a dozen generated files.

“The boilerplate you’ve written a hundred times, written once and reused forever.”