Data and content

What it is for. Your own Supabase project: its database, sign-in and file storage. It is optional, because every app already has a backend. Choose it when you want an app's data in a project that is yours. While Supabase is on for an app, that app uses it for data, sign-in and files in place of the built-in backend.

Connect. Paste the Project URL (like https://abcdefgh.supabase.co) and the Anon Key, both from Supabase under Project Settings, then API. The anon key starts with eyJ or sb_publishable_; use Supabase's copy button, since a key cut short is refused. The Service Role Key is optional, and starts with eyJ or sb_secret_.

Creating the tables. Press Connect Supabase account, sign in at Supabase and approve. Then, in an app that needs tables, Manage, then Cloud, has a button that creates them in your project each time you press it. The permission stays on our servers. Without it, the same SQL is there to copy into Supabase yourself. Once your account is connected, a Your projects list also lets you press Use this project instead of pasting the keys.

Ask. "Save the bookings in my Supabase and let customers sign in with email." "Add a table for products with a name, a price and a photo."

Good to know. Apps on your own Supabase cannot use Secrets yet. To move an app that already has data, see Advanced settings.

What it is for. Your own Postgres on Neon as the app's database. Setherion reaches it through Neon's Data API, and Postgres itself decides who sees which row, by row-level security. That fits an app where each person sees their own rows, a catalogue anyone may read, or a team view.

Connect. Paste the Data API address from Neon: your project, then Data API, the REST endpoint ending in /rest/v1. It has to be on neon.tech. Then press Test connection. Until Neon has been told to trust Setherion it refuses, and the result gives you the JWKS address to paste into it.

The JWKS step. In Neon, open Data API, then Authentication, choose a custom provider and paste that JWKS address. Leave the audience empty. This is how Neon learns to trust the signed-in person Setherion sends with each call. If Test still says no after a few minutes, remove the provider in Neon and add it again.

Ask. "Keep a to-do list for each signed-in person in my Neon database." "Show the products table from Neon as a shop page, filtered by category."

Permissions. Three switches under Permissions: read rows, add, change and delete rows, and run database functions.

Good to know. The tables exist only once you have run the SQL the AI writes for them (a file called neon/setup.sql), once, in Neon's SQL Editor. A visitor who is not signed in reaches only what you granted Neon's anonymous role.

What it is for. Firestore for data and Firebase Authentication for sign-in, from your own Firebase project. Nothing else of Firebase is built.

Connect. Three values, from the web app settings of your project in the Firebase console: the API Key (starts with AIza), the Project ID and the App ID (like 1:123:web:abc). All three are public by design and go into the published app. There is no Test connection for Firebase: Connect keeps the values.

Ask. "Let people sign up and keep a private list of notes in Firestore." "Show a live list of messages from my Firebase project."

Good to know. At Firebase the key is not what protects your data: the security rules are. Anyone can read the settings out of a published app, so a project left in test mode is open to the whole internet. Set the Firestore rules in the Firebase console before the app stores anything personal. The AI writes each document so that it belongs to a user id from Firebase Authentication, and says this on screen when the app stores personal data.

What it is for. A table of rows as the app's database: a CRM, a stock list, content you keep in Airtable.

Connect. Press Connect with Airtable, sign in and tick the bases the app may use, then press Choose base and pick one. Or use keys instead: a Personal Access Token (starts with pat) from your Airtable account, and the Base ID (starts with app, shown in the address of your base).

Ask. "Show my stock from the Products table in Airtable, with the photo and price." "Add each enquiry from the contact form as a new row in my Enquiries table."

Limits. Apps reach the one base you chose and nothing else in your account, even if the token could do more. A table with spaces in its name is handled for you. Airtable returns long tables a page at a time, and the app is told to fetch every page or to say that the list is partial. Test connection reads the base's tables, so it fails if that base was not ticked.

What it is for. A Notion database as a light content system or task list, and Notion pages shown or filled in by an app.

Connect. Press Connect with Notion, sign in and tick the pages the app may use. The app can then read and write those pages and nothing else. Or use a token: create an internal integration at notion.so/my-integrations and paste its Internal Integration Token (starts with ntn_ or secret_), with an optional Default Database ID. With a token, share each page or database with the integration in Notion, or Notion answers 404 to everything.

Ask. "Show the team page from my Notion database, with each person's photo and role." "Add every form message as a new row in my Notion tasks."

Limits. One query returns at most 100 rows, so for a long database the app is told to keep asking until Notion says there are no more.

Good to know. The AI that builds your apps can also read your Notion through an MCP server, which is separate: see MCP servers.

What it is for. A spreadsheet you edit as the app's data: prices, a menu, listings, team members, and sign-ups collected into rows.

Connect, with the button. Press Connect with Google, sign in, then press Choose spreadsheet and pick the one file. The sheet stays private, the app reads and writes it through Setherion, and the rest of your Drive stays out of reach.

Connect, with a key. Paste a Google API key with the Google Sheets API enabled in Google Cloud, restricted to that API and to your site, and the sheet id. This way works only on a sheet shared as "anyone with the link can view", and only reads.

Ask. "Show the price list from my sheet and update it when I edit the sheet." "Add each booking request as a new row at the bottom of my sheet."

Limits. With the button, one spreadsheet and the tabs in it. A range names a tab, so if you rename a tab, say so in the chat.

What it is for. The published posts, pages and media of a WordPress site, shown inside an app: a blog, a news page, a portfolio.

Connect. The Site address (it has to start with https://), a Username, and an Application password. Make that one in WordPress under Users, then Profile, then Application Passwords, then Add New. WordPress.com's free plan does not offer them. Test connection signs in to the site.

Ask. "Add a blog page that lists my 10 newest WordPress posts with their images." "Show each post on its own page, from its slug."

Permissions. One Read switch each for posts, pages, images and files, categories, tags and comments.

Good to know. Nothing is ever written to the site. Posts and pages are shown as published, and comments as approved. The text of a post comes as HTML from your own site, so the app draws it with its own typography.

What it is for. Entries written in Contentful: articles, products, pages, team members, whatever your content types are.

Connect. The Space ID (Settings, then General settings) and the Content Delivery API token (Settings, then API keys). Use the delivery token, not the management one. The Environment is optional and is master when left empty. Test connection reads your content types.

Ask. "Show my blog posts from Contentful, newest first, with the cover image." "Make a page for each product entry, found by its slug."

Permissions. One Read switch each for entries, images and files, and content types.

Good to know. Field names come from your content model, so the AI reads the content types first rather than guessing. A rich text field arrives as a document tree that the app draws itself.

What it is for. Stories, pages and blocks written in Storyblok: a blog, a landing page, a list of products or team members.

Connect. An Access token: in Storyblok, Settings, then Access tokens, a Public token. The Region is optional: eu (the default) or us, as shown in your space settings.

Ask. "List the newest stories under the blog folder." "Build the About page from the story with the slug about."

Permissions. One Read switch each for stories, links, datasource entries and tags.

Good to know. Only published content is ever read: Setherion forces it, so a preview token pasted by mistake cannot put drafts on a public page. A story is a tree of blocks, and the app draws the ones your space uses.

What it is for. The collections you write in the Webflow CMS: a blog, a team, a menu, projects or locations.

Connect. A Site API token. In Webflow open Site settings, then Apps & integrations, then API access, and generate a token with CMS and Sites set to Read-only.

Ask. "Show the newest blog posts from my Webflow collection." "Give every team member their own page, from the item slug."

Limits. Only published items are read. They come from Webflow's cache, so a change can take a few minutes to show. The calls that find your site and its collections count against Webflow's limit of 60 a minute on the smaller plans, so the app is told to keep their answers for a day instead of asking on every visit. This connector has no permission switches.

What it is for. Files people upload in your apps (photos, documents, attachments), kept in your own S3 bucket. The built-in backend keeps records and no files, so this is where uploads go.

Connect. Four values: the Bucket region (like eu-west-2, which is London), the Bucket name (lowercase letters, digits and dashes, no dots), and an Access key ID and Secret access key from AWS under IAM, then Users, a user made only for Setherion, then Security credentials, then Create access key. The secret is shown once. Test connection reads the bucket, then uploads a small test file through a signed link, reads it back, deletes it, and checks that your bucket lets browsers upload. If that last check fails, look first at the bucket's CORS settings.

Ask. "Let customers attach a photo to their repair request." "Show each order's uploaded documents on the order page."

Limits.

• Files are up to 25 MB each.
• Every app gets its own folder in the bucket, apps/ followed by the app's id, and Setherion refuses any key outside it. One bucket can serve all your apps without one reading another's files.
• Visitors cannot list files. A file is reached by its key, which the app keeps with the record, and links that show a file last an hour.
• Listing and deleting an app's files is for the app's team only. Uploading and showing are open to anyone using the app.

Permissions. Three switches: upload files, show files, and list and delete files.

Good to know. A file picker in the editor's preview uploads to your real bucket, just like the published app.

What it is for. Uploading images and files from an app, and delivering them at the size shown, through Cloudinary's CDN.

Connect. Four values: Cloud Name, an Unsigned Upload Preset, an API Key and an API Secret. Make the preset in Cloudinary under Settings, then Upload, as an unsigned one. Keys are under Settings, then API keys. Without a preset, uploading cannot work, and the app says so instead of pretending.

Ask. "Let sellers upload product photos and show them at the right size." "Add a gallery page where visitors can send in pictures."

Limits. The browser uploads straight to your Cloudinary with the preset. The cloud name and the preset go into the published app, as Cloudinary intends. The API secret does not: Setherion uses the key and secret only for Test connection, so no secret ever sits in the app. Every upload and every view is on your Cloudinary account.

Good to know. The File upload skill is built on this connector: see Skills.

What it is for. Instant, search-as-you-type over products, articles or any items you index.

Connect. Three values from the Algolia dashboard under Account, then API keys: the Application ID, the Admin API Key and the Search-Only API Key.

The two keys. Visitors search in their browser with the search-only key, which is safe to publish and goes into the app. The admin key can delete an index, so it never leaves our servers: the app uses it through Setherion only to index records. With no search-only key saved, search cannot run, and the app says so instead of falling back to the admin key. Deleting records or an index, emptying one, or moving one over another is for your team only; adding and updating records works for anyone using the app.

Ask. "Add a search box to the shop that finds products as I type." "Index my products in Algolia when I add one."

Good to know. The Search skill is built on this connector: see Skills.