Connecting anything
HTTP in,HTTP out, awkward parts handled.
Every automation tool advertises a number of integrations. The number is always large and it is always the wrong question, because the system you actually need is the one built in-house in 2014 by somebody who has left. What matters is how well the tool speaks the protocol underneath all of them.
The ready-made connections
The applications most businesses run on have prepared steps: shops and marketplaces, accounting and invoicing, spreadsheets and databases, calendars and mail, storage and messaging, CRMs and helpdesks, payment providers and shipping carriers. You authorise the account once and the fields are named in the language the application uses, not in the language of its JSON.
Where an application has a Polish-market particularity — an invoicing system that has to be KSeF-ready, a carrier whose labels are a national standard — the prepared step knows about it, because the family sells into that market and had to learn.
And then the general case
Everything else is an HTTP step, and an HTTP step here is not a consolation prize. It is the same machinery the prepared connections are built on, with the same handling of the parts that are tedious to write yourself.
The tedious parts
Handled,
so you do not write them again.
Authentication
API keys, bearer tokens, basic auth, OAuth 2 with refresh, HMAC request signing, mutual TLS. A credential is stored once, referenced by name, and never printed into a log or a run record.
Pagination
Cursors, page numbers, offsets, Link headers, and the API that signals the end by returning an empty array. Say which shape it is and the step walks the whole set.
Rate limits
A ceiling per connection, respected across every workflow that uses it. When a provider answers 429 with a Retry-After, the step waits that long rather than hammering.
Retries and backoff
Transient failures retried with an increasing gap and a cap. A step is a pure function of its inputs, so a retry re-runs the step rather than re-running the run.
Awkward payloads
JSON, form encoding, XML, plain text, multipart uploads. Responses parsed into fields you can reference by name, including the ones nested four levels down.
Timeouts
A per-step limit, so one slow dependency cannot hold a worker while everything behind it queues. What happens when the limit is hit is your decision, per step.
If it speaks HTTP,
you are already connected.
Incoming webhooks,
taken seriously.
Every workflow can have a URL that starts it. That URL verifies signatures — HMAC in the shapes the common providers use, and a shared secret where that is all the sender can manage. An unsigned request to a workflow that expects a signature is rejected and recorded, not quietly processed.
Deduplication is on the payload's own identifier, so a sender that retries because it did not see your 200 in time gets one run rather than three. Malformed payloads are kept, with the reason they were rejected, because the commonest cause of a mysterious gap in an automation is a sender that changed its mind about a field.
The systems that only speak CSV.
They exist. A file appears on an SFTP server at four in the morning, or arrives as an attachment, or is dropped in a shared folder. A workflow can watch for it, read it, and treat each row as a record — including the file with a byte-order mark, semicolon separators and a header row in Polish, because that is what the export actually looks like.
Going the other way works too: a workflow can assemble a file and put it where the other system expects to find it, which is frequently the only interface a piece of software from 2006 has.
- ⚡TriggerNew file on the supplier's SFTP:
stock-2026-09-09.csv. - 2ParseSemicolons, byte-order mark, Polish headers. 4 118 rows.
- 3NormaliseCurrency codes checked against reference data; two rejected as invalid.
- 4PushHTTP
PATCHin batches of 200, rate limit respected. - !ExceptionsTwo rows filed for a person, with the row number and the reason. The other 4 116 went through.
Steps that called a model: 0Cost of this run: nothing
Where credentials live.
Encrypted, referenced by name, scoped to the workspace that owns them, and never rendered into a run log, an error message or a support conversation. A run record shows that a step authenticated as supplier-sftp; it does not show what supplier-sftp is.
An agency running one workflow for thirty clients gives each client its own credential set, and the workflow refers to the set rather than the secret. Rotating a key is one edit in one place — which is most of the reason agencies come here.
The limit worth knowing: a system with no interface at all — no API, no webhook, no file drop, nothing but a person clicking in a browser — cannot be automated by this or by anything else honest. There is no headless browser pretending to be a user here, because that breaks the first time the other side moves a button, and it breaks silently.