POPPY | CONNECTIONS

Connect the services. Light up Poppy 3.0.

Wave 3's backend is in — the engine is built. What it needs now is the real‑world plugs: login providers, SMS, payments, the marketing mail domain, the MLS feed. Here's the exact punch list — who owns each, the steps, and what to hand back. For Shattique & Omkar.

15 connected 8 need you 3 owners

Secret hygiene — read first. Never paste a key, token, or password into chat, a ticket, or a lane message — the transcript keeps it forever. Secrets go only into the Supabase Dashboard Vault (typed there) or the provider's own config field. The backend reads them at runtime. Below, every "hand back" says exactly where it goes — and it's never here.

Owners

Who takes what

Two doers and a platform owner. Shattique = accounts, business relationships, admin consoles. Omkar = technical wiring (Supabase, DNS, webhooks). Mike = platform‑owner approvals only (paid accounts, the one Composio toggle).

ShattiqueAccounts · consoles · MLS
OmkarWiring · DNS · webhooks
MikeApprovals · billing · toggle
Needs you

The punch list — 8 connections

In rough priority. Each card is self‑contained: what it powers, who owns it, the steps, and what to hand back (and where).

Apple Sign‑In

Login provider · owner‑scoped saved searches
Needs account
ShattiqueMike · $99/yr
  • Enroll in Apple Developer ($99/yr) at developer.apple.com.
  • Certificates, IDs & Profiles create a Services ID and a Sign in with Apple key.
  • Set the return URL to https://mbnakfrkfwxinhxlisyq.supabase.co/auth/v1/callback.
Hand back: Services ID + the key file (and Team ID). Where: Supabase Authentication Providers Apple (paste in the dashboard). Then Omkar flips it on.

Microsoft / Azure

Login provider for brokerages on Microsoft 365
Needs app reg
Shattique
  • portal.azure.com App registrations New registration.
  • Redirect URI (Web): https://mbnakfrkfwxinhxlisyq.supabase.co/auth/v1/callback.
  • Certificates & secrets new client secret; copy the Application (client) ID.
Hand back: client ID + client secret. Where: Supabase Authentication Providers Azure (dashboard). Omkar enables.

Google login (enable)

sign‑in.html already has the button — provider just needs turning on
Half done
Omkar
  • Google Cloud Console OAuth consent + Credentials OAuth client (Web).
  • Authorized redirect: …supabase.co/auth/v1/callback.
  • Supabase Auth Providers Google: paste client ID/secret, toggle on.
Result: the existing Google button on sign-in.html goes live. Also flip on email/password + magic link (already built) and finish the passkey device‑test.

Twilio (SMS)

Showing texts · stage notices · saved‑search SMS alerts
Needs account
Shattique · provisionOmkar · wire
  • Create/confirm the Twilio account; provision a sending number (or confirm TWILIO_FROM is live).
  • Grab Account SID + Auth Token.
  • Give Omkar one destination cell for the end‑to‑end test.
Hand back: SID, Auth Token, From‑number. Where: Supabase Vault as TWILIO_ACCOUNT_SID / TWILIO_AUTH_TOKEN / TWILIO_FROM. pure‑comms reads them at runtime.

Stripe (payments)

Marketplace billing + membership dues — the whole revenue rail
Needs account
Mike · business acctOmkar · wire
  • Create the Stripe business account (Mike) verify the entity.
  • Developers API keys: secret key + publishable key; add a webhook signing secret.
  • Omkar wires checkout + webhook to pure_books / billing.
Hand back: publishable key (front‑end config OK), secret + webhook secret Vault (STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET). Never the secret key in chat.

Marketing mail domain

Tracked marketing email (transactional is already live)
Transac. live
Omkar
  • Resend: add mail.acquisto.biz with click‑tracking ON.
  • Add the verification + DKIM/SPF DNS to Netlify DNS (automatable via Netlify API).
  • Set MARKETING_FROM in Vault (tracked sends return 503 until this is set).
Note: transactional email is already live (Resend, noreply@acquisto.biz verified). This unblocks tracked marketing sends + closes the open‑relay gate (t-comms-secure) before real volume.

Mailboxes (Zoho)

Real inboxes e.g. purechat.ai@acquisto.biz
Not set up
Shattique · Zoho adminOmkar · DNS
  • Add acquisto.biz to Zoho Mail (acquistorealestate.com already runs on Zoho).
  • Add MX + SPF + DKIM to Netlify DNS.
  • Create the mailboxes in the Zoho admin console.
Hand back: nothing secret — just confirm the inboxes resolve. Powers inbound‑email ticket intake (drop a doc / email a ticket to Poppy).

MLS feed (RETS)

Live search at scale on acquisto.biz (RESO scoped for v4)
Creds needed
Shattique · MLSOmkar · wire
  • Confirm the RETS credentials used on acquistorealestate.com (login URL, user, password) are licensed for acquisto.biz.
  • Provide them to Omkar to wire the feed to Pure search.
  • Admin toggle RETS⇄RESO already scoped — RETS stays primary now.
Hand back: RETS URL + user + password Vault. Powers the omni‑search bar across the product.
Platform owner — Mike only

Two toggles only you can flip

Composio auto‑approve

Lets Code's sandbox call Composio at runtime
Toggle
Mike

In the MCP server for connect.composio.dev/mcp, set tool execution to AUTO / no‑approval. No secret, nothing to hand off — it's purely the per‑call approval policy. This is the real lever (not a missing key).

GitHub PAT (optional)

Design self‑deploy — deploy already works through Poppy
Optional
Mike

Only if you want lanes self‑deploying without the Poppy path: create a fine‑grained PAT yourself and add it to the shared workbench config (not chat). Deploys currently route through Poppy fine, so this is a convenience, not a blocker.

Already connected

15 services live today

So nobody re‑does work — these are wired and powering surfaces right now (live read from Poppy's connectors map).

Loading…
Connections punch list · graded live by Poppy · secrets to Vault, never to chat

Live from mcp_connectors_ready — every integration Poppy can reach, with its real status.