API integrations,
built on a secure gateway.
In BEAR OS, API integrations don't call services directly — they route through one secure gateway. Connect a service and its credentials are encrypted at rest in a vault; the gateway then resolves auth per call, refreshes OAuth tokens before they expire, retries on an expired token, backs off on rate limits, enforces scopes, and logs every call. Your Buffer account is connected and logged today, with more integrations and an MCP marketplace in development.
How every integration is handled
Encrypted credentials
Connection secrets are encrypted with AES-GCM before they hit the database. Plaintext tokens are never stored and never returned to the browser — the gateway decrypts only in memory to make a call.
OAuth with auto-refresh
OAuth tokens refresh proactively before expiry, and the gateway retries once on an expired-token 401 — so an integration keeps working without a manual reconnect.
Rate-limit & retry logic
Honors Retry-After on 429s, backs off on 5xx within a capped retry budget, and enforces the scopes granted to each connection.
Every call logged
Provider, action, HTTP status, success, attempts, duration and error are recorded on every outbound call — a complete action trail.
Test connection, for real
A verify action runs a real authorized call through the gateway and reports live health, so you confirm an integration instead of guessing.
Idempotent inbound events
Inbound webhooks land in a deduplicated sink, so a provider retrying the same event never double-processes it.
Connected now, and what's next
BufferLIVE
Publishing runs through your connected Buffer account today, and every account, channel and publish call is routed and logged through the gateway.
StripeLIVE
Billing is wired with signature-verified webhooks (activating when Stripe keys are configured) so subscription events are trusted end to end.
GoogleREGISTERED
Registered as an OAuth provider through the same gateway; it activates the moment its credentials are configured — no code change needed.
MCP marketplace & more APIsCOMING
A curated catalog of remote MCP servers and additional API integrations is in active development on top of this gateway, with every tool call logged and writes approval-gated.
API integrations FAQ
How do API integrations work in BEAR OS?
Every outbound call goes through one secure gateway rather than each feature calling an API directly. When you connect a service, its credentials are encrypted at rest in a vault — plaintext tokens are never stored — and the gateway resolves auth per call, refreshes OAuth tokens before they expire, retries once on an expired token, backs off on rate limits, and writes every call to an action log. That gives you one consistent, auditable path for all integrations.
Which API integrations are live today?
Publishing runs through your connected Buffer account today, and every Buffer call is routed and logged through the gateway. Google is registered as an OAuth provider and activates when its credentials are configured. Stripe billing is wired with signature-verified webhooks. A broader catalog of integrations and an MCP marketplace are in active development and clearly labeled as coming.
Are my API keys and tokens stored securely?
Yes. Connection secrets are encrypted with AES-GCM before they touch the database and are never returned to the browser in plaintext. The gateway decrypts a secret only in memory to make an authorized call, enforces the scopes granted to that connection, and records the outcome — provider, action, status and timing — in the action log.
Can I see what each integration did?
Every gatewayed call is recorded: which provider, which action, the HTTP status, whether it succeeded, how many attempts it took, how long it ran and any error. That audit trail powers connection health checks and a Test connection action, so you can verify an integration with a real authorized call instead of guessing.
How much do API integrations cost?
Integrations are part of the platform on Starter $49, Growth $149 and Studio $399 per month — not billed as add-ons. Every workspace starts on a free trial with 60 posts per month across 4 channels, no card required.
Connect once. Trust every call.
Early access is open in waves. Founding members lock early-access rates on every plan.