A connector is an account the user has linked to a brand workspace. Tools that publish, read insights or manage campaigns act through one — so post_to_x works when X is connected and answers 401 when it is not.
Generated from the shipped connector table. The description and capability chips below are the same strings the product renders on its own Connectors page, and the approval notes are the same gate table the server enforces. Nothing here is a second copy that can drift.
Social & Publishing
Meta
Post to Facebook & Instagram, build and run ad campaigns with full targeting and audiences, collect leads with instant forms, read how posts and ads performed, and reply to or hide comments. A published Instagram post can be deleted but never edited — Meta allows no change to it at all.
FacebookInstagramAd campaignsLead formsInsightsComments
- Key
meta- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Telegram
Post to a channel, group or chat as your own bot. 4096 characters of text, 1024 with media. Telegram cannot list a bot’s chats, so you name the destination.
PostScheduleCarouselVideoDelete
- Key
telegram- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Bluesky
Post as your account — text up to 300 characters, plus EITHER up to 4 images OR one MP4 video, never both. Links are made clickable for you. Video needs a confirmed email on your Bluesky account.
PostScheduleImagesVideoDelete
- Key
bluesky- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Threads
Publish text, image or video posts, repost anyone, read how they performed, reply to and hide replies, search Threads, and delete a post. Threads has no edit — only delete and repost.
PublishRepostInsightsRepliesSearchDelete
- Key
threads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
YouTube
Publish videos to your channel — public, unlisted or private — then read performance and reply to comments.
PublishCommentsAnalytics
- Key
youtube- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
TikTok
Publish a video or a photo post (up to 35 images) — live, or into drafts. Read back how each one did. TikTok’s API can’t delete or edit a post once it’s up; that’s done in their app.
PostingPost statsFollower stats
- Key
tiktok- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
LinkedIn
Post to a company Page or your profile, and run LinkedIn ad campaigns. Which identities this brand may act as is yours to choose — your profile is off unless you turn it on.
PublishingCompany PagesAd campaigns
- Key
linkedin- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
X (Twitter)
Post, thread, poll or reply, and read performance and mentions. X charges per API call, so every action costs a few credits.
PublishThreadsAnalyticsPollsMentions
- Key
x- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Snapchat approval pending
Publish a finished video to your Public Profile as a Story or a Spotlight, and group Snaps into a Saved Story. Video only — 5–60s for a Story, 6–60s for a Spotlight, 540x960 minimum.
StoriesSpotlights
- Key
snapchat- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Snapchat posting is NOT BUILT — there are no Story, Spotlight or Saved Story tools or routes in Hermoso, only an OAuth descriptor. Snap has also not allowlisted this app for the Public Profile API (their own words: "The Public Profile API is currently allowlist only"), so BOTH the code and the access are outstanding. Snapchat ADS is a separate connector and is fully built and live.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set SNAPCHAT_PROFILE_API_APPROVED=1 — but that is the SECOND of two steps and on its own it would offer a connector a user can authorize and then do nothing with. Step one is to build the publish path: Stories, Spotlights and Saved Stories have no tools and no routes today. Step two is Snap allowlisting the client id (a request to a Snap point of contact, who enables it against the OAuth app); no deploy is needed beyond the env var. snapchat_ads is unaffected either way.
Reddit approval pending
Post to a subreddit, read and answer the comments, edit a text post’s body or delete it. One subreddit at a time — Reddit bans cross-posting. Titles can never be edited.
PublishCommentsEditDelete
- Key
reddit- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Reddit has not approved API access for this app yet (approval ticket, not a credential).
Everything above is built and tested; what is missing is the platform's approval, not the code. Set REDDIT_API_APPROVED=1 alongside REDDIT_CLIENT_ID/REDDIT_CLIENT_SECRET once the ticket is granted.
Pinterest
Publish image and video Pins to a board you pick, edit or delete Pins and boards afterwards, and read how each one did.
PublishBoardsEditDelete
- Key
pinterest- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Google Business Profile approval pending
Post updates, events and offers to your Google Search & Maps listing, and read the calls, clicks and directions they drive.
PublishOffersInsights
- Key
google_business- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Google has not allowlisted the Business Profile API for this project yet — every Business Profile API reads 0 QPM, so locations, insights and Q&A 403 alongside posting and reviews.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set GOOGLE_BUSINESS_API_APPROVED=1 once Google grants the project access — no deploy needed beyond the env var. The other two steps are already done: the v1 APIs are enabled, and the business.manage scope is declared (2026-08-19). On grant day also run `gcloud services enable mybusiness.googleapis.com`, which is what posting and reviews need.
Advertising
Meta
Post to Facebook & Instagram, build and run ad campaigns with full targeting and audiences, collect leads with instant forms, read how posts and ads performed, and reply to or hide comments. A published Instagram post can be deleted but never edited — Meta allows no change to it at all.
FacebookInstagramAd campaignsLead formsInsightsComments
- Key
meta- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Google Ads
Campaigns, budgets and reporting for Google Ads. New campaigns start paused, so nothing spends until you enable them.
ReportingCampaignsBudgets
- Key
google_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Microsoft Ads
Campaigns, ad groups, search ads, keywords, budgets and reporting on Bing. Everything starts paused, so nothing spends until you activate it.
ReportingCampaignsBudgets
- Key
microsoft_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Apple Ads
App Store search ads and Ads on Apple Maps, all created PAUSED. An App Store ad renders from your App Store Connect product page, not an image you upload; a Maps brand ad uses your own image and copy.
CampaignsKeywordsReportingCreatives & adsApple Maps brands
- Key
apple_ads- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
ChatGPT Ads
Ads inside ChatGPT — the sponsored card under an answer. Campaigns, budgets and reporting; one format only, a text + image card, no video. Everything starts paused.
ReportingCampaignsBudgets
- Key
openai_ads- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
LinkedIn
Post to a company Page or your profile, and run LinkedIn ad campaigns. Which identities this brand may act as is yours to choose — your profile is off unless you turn it on.
PublishingCompany PagesAd campaigns
- Key
linkedin- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
TikTok Ads
TikTok ad campaigns, budgets and reporting. Everything starts paused — nothing spends until you say so.
Ad campaignsReporting
- Key
tiktok_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Snapchat Ads
Snapchat campaigns, ad squads, budgets and performance. Everything starts paused, so nothing spends until you say so. Headlines run up to 34 characters.
Ad campaignsReporting
- Key
snapchat_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Reddit Ads
Reddit ad campaigns, ad groups, budgets and reporting. Everything starts paused, so nothing spends until you say so.
Ad campaignsReporting
- Key
reddit_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
X Ads
X (Twitter) campaigns, line items, promoted posts, targeting and reporting. Everything starts paused, so nothing spends until you say so.
Ad campaignsReporting
- Key
x_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Pinterest Ads
Pinterest campaigns, ad groups, budgets and reporting, promoting Pins that are already live. Everything starts paused, so nothing spends until you say so.
Ad campaignsReporting
- Key
pinterest_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Analytics
Google Analytics
GA4 traffic, conversions and realtime activity by channel, campaign or landing page, plus key events and custom dimensions. GA4 only. Only properties you tick under Manage accounts are readable.
ReportsRealtimeProperties
- Key
google_analytics- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Google Tag Manager approval pending
Your site’s analytics and conversion tags. Audit what is already live, stage new ones, and publish when you say so — staging never goes live on its own. Google rate-limits this API hard, so reads are deliberately unhurried.
Tag auditConversion tagsTriggersPublish
- Key
google_tag_manager- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. GOOGLE_TAG_MANAGER_SCOPE_DECLARED is unset in THIS environment. Note this is no longer a paperwork blocker: all three Tag Manager scopes — `tagmanager.edit.containers` (read + stage), `tagmanager.edit.containerversions` (turn a workspace into a version) and `tagmanager.publish` (make that version live) — are declared on the consent screen and were APPROVED by Google OAuth verification on 2026-08-20 for project 209678518568. They are SENSITIVE (measured 2026-08-19), which is why that submission was needed; approval makes them usable, not non-sensitive.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set GOOGLE_TAG_MANAGER_SCOPE_DECLARED=1 — no deploy needed beyond the env var, and it is ALREADY SET ON PROD (revision hermoso-00997-qn2), so if you are reading this the environment you are in is not production. Both prerequisite steps are DONE: all three scopes are declared on the Data Access page of ad-inspiration-499417 (the project that owns the OAuth client, settled by the numeric prefix 209678518568 and never by the project NAME) — https://www.googleapis.com/auth/tagmanager.edit.containers, https://www.googleapis.com/auth/tagmanager.edit.containerversions and https://www.googleapis.com/auth/tagmanager.publish — and Google approved the verification re-submission for exactly those three on 2026-08-20. The three had to be declared TOGETHER and were: the publish path calls workspaces.create_version, which the vendor scopes to edit.containerversions ALONE, and versions.publish, which it scopes to publish ALONE, so a submission for publish without containerversions would have shipped a publish path that 403s on its first call and cost a second demo video. The Tag Manager API was enabled on that project 2026-08-19, which is a prerequisite for the scopes to be selectable at all.
Google Search Console approval pending
Impressions, clicks, CTR and position for the organic traffic Google sends you — the one place real search terms still exist. Plus live index status per page, and sitemap submit/remove.
Search termsIndex statusSitemaps
- Key
google_search_console- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. GOOGLE_SEARCH_CONSOLE_SCOPE_DECLARED is unset, so the connector is held back even though the `webmasters` scope is now declared on the consent screen (2026-08-19).
Everything above is built and tested; what is missing is the platform's approval, not the code. Set GOOGLE_SEARCH_CONSOLE_SCOPE_DECLARED=1 — no deploy needed beyond the env var, and it is already set on prod. The two prerequisite steps are DONE: https://www.googleapis.com/auth/webmasters is declared on the Data Access page of the project that owns the OAuth client (non-sensitive; it did not re-trigger verification), and it is in the declared table in tools/google-scope-parity-check.mjs so the two sides cannot drift.
Bing Webmaster Tools
Bing search terms, clicks and position, crawl issues and inbound links — plus keyword research with real impression volumes and no ad spend. Bing also feeds Copilot.
Search termsKeywordsCrawl
- Key
bing_webmaster- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
PostHog
Per-user funnels, retention and session replay — the questions GA4 cannot answer. Replays come back as links you open in PostHog.
HogQLInsightsSession replay
- Key
posthog- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Mixpanel
Retention cohorts, event breakdowns and the events a project actually records — plus any saved Mixpanel report, read straight back by its id.
InsightsRetentionEvents
- Key
mixpanel- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Amplitude
Event segmentation, funnels with a conversion window, retention curves, and one person’s full activity stream — found by user id, device id or just the start of one.
FunnelsRetentionUser activity
- Key
amplitude- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.