Blog ·
Add OpenAI, Stripe, or Slack to an AI-built app without pasting API keys into code
White Ghost integrations work in two steps: connect a service once, attach it to an app. The code never sees the credential. 25 services in the catalog.
The riskiest file in most AI-built apps is the one holding the API keys. White Ghost removes it: you connect a service (say OpenAI or Stripe) once at the workspace level, attach it to the app that needs it, and the platform injects the credentials securely. The code never receives the key, so the key can never end up in the repository, in a chat transcript, or in an assistant's context window.
The two-step model
- Connect once. In the Integrations section of the console, connect the service to your workspace. This is where the credential lives, entered once by you.
- Attach per app. Each app attaches the services it uses, one connection per service per app. From the app's point of view the integration is standard HTTP REST, so the provider's official SDK works by pointing its base URL at the integration.
The catalog covers 25 services today, across AI (OpenAI, Anthropic, Gemini, Groq, ElevenLabs, Replicate), search and data (Firecrawl, Exa, Algolia, Pinecone), payments and messaging (Stripe, Resend, SendGrid, Postmark, Twilio, Slack, Discord, Telegram), and product tooling (Mapbox, PostHog, Sentry, GitHub, Notion, Linear, Airtable, Melonn). Every integration exposes the provider's full API, not a reduced wrapper.
And when the service is not in the catalog
Nothing breaks: store the key as a secret, read it from the environment, and call the API over plain HTTP. White Ghost apps have no outbound restriction. Secrets are created in the console or with the ghosty CLI and are applied without a redeploy, so rotating a key does not mean rebuilding the app.
Why this matters when an assistant writes the code
An AI assistant will happily hardcode whatever credential it finds in its context. The safest key is the one the assistant never sees. With attached integrations, what the assistant writes is ordinary SDK code with a different base URL, and what actually authenticates the call never passes through the conversation. You get the provider's full API, the assistant gets a clean pattern to follow, and the repository stays free of secrets.
Frequently asked questions
What services are in the catalog?
OpenAI, Anthropic, Gemini, Groq, ElevenLabs, Replicate, Firecrawl, Exa, Algolia, Pinecone, Stripe, Resend, SendGrid, Postmark, Twilio, Slack, Discord, Telegram, Mapbox, PostHog, Sentry, GitHub, Notion, Linear, Airtable, and Melonn. Each one exposes the provider's full API.
What if the service I need is not in the catalog?
Use it the normal way: store the key as a secret in White Ghost, read it from the environment, and call the service over HTTP. Apps have no outbound restriction, so any API on the internet works.
Do I still use the provider's official SDK?
Yes. Attached integrations are exposed to your app as standard HTTP REST, so the official SDKs work by changing their base URL. Your assistant can set this up in one edit.
Do secrets require a redeploy?
No. Secrets are created in the console or with the ghosty CLI and applied to the running app without a redeploy.