Connect
Set up Slack, GitHub, Linear, GA4, or a warehouse at the team. Your code asks Connect for a token when it has work. No provider API key in environment variables.
Runtime
getToken · slack/acme-slack
import { getToken } from "@sarksh/connect";
const token = await getToken("slack/acme-slack");Your code
getToken
identity + uid
Connect
Mint access
refresh / unwrap
Provider
Short-lived token
use immediately
Model
A team-owned login to Slack, GitHub, Linear, GA4, Ads, or a warehouse you already run. Authorize once. The secret stays in the vault.
Your code asks Connect at the moment it needs access. Connect returns a short-lived provider credential. Nothing from the provider lives in env.
A pipeline extract, an ontology module, the CLI, or an agent. They store the connector id and call getToken. They never hold the refresh token.
How
Your code authenticates to Connect. Connect authenticates to the provider. The round trip is the runtime credential exchange.
OAuth or an API key at the team. Connect stores the refresh token or secret in the vault. The dashboard never shows it again.
Pipelines and ontology use a workload identity. Local and CLI pass a mint key (SARK_CONNECT_TOKEN). Same check: this caller may use this connector.
Connect refreshes or unwraps, and returns a short-lived access token or the static secret. Your code uses it immediately against the provider — or invokes a catalogued operation.
Connectors
Official connectors are code in the registry. OAuth where the provider has it. An API key or URI when that is the grant.
slack
Post messages and list conversations through a workspace install.
github
Open issues and read repos through an org or user OAuth grant.
linear
Read and write issues against a workspace.
notion
Search pages and query databases the integration can see.
stripe
API key at create time. Balance, customers, payment intents.
ga4
Google Analytics reports. Property is picked on the connector.
google_ads
Campaign performance and search terms. Customer is picked on the connector.
search_console
Query analytics for a verified site.
bigquery
SQL you already run. Project and dataset stay on their side.
databricks
A SQL warehouse in their workspace. Host plus warehouse id.
postgres
A connection URI. Sark pings and runs read-only SELECT.
posthog
Personal API key plus a project. Events, persons, HogQL.
Are
Are not
FAQ
Get started