A connector is an account the user has linked to a brand workspace. Tools that publish, read insights or manage campaigns act through one — so post_to_x works when X is connected and answers 401 when it is not.
Social & Publishing
Meta
Facebook & Instagram posts, ads, comments and DMs (Messenger + Instagram Direct, message requests included). A Page-less Instagram account uses the Instagram connector. Posts can never be edited.
FacebookInstagramAd campaignsLead formsInsightsCommentsDMs
- Key
meta- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Instagram
An Instagram account on its own, no Facebook Page needed. Everything Meta does for Instagram, minus ads. A Page-linked account, or one you advertise on, goes on Meta instead, never both.
PublishReelsCarouselInsightsCommentsDMs
- Key
instagram- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
WhatsApp approval pending
Message customers from the business’s own WhatsApp number, once they have opted in. Use this only for a number you don’t have yet; one you already manage is ticked on Meta instead, never both.
MessagingTemplatesInboxBroadcasts
- Key
whatsapp- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Meta App Review has not granted advanced access to whatsapp_business_management and whatsapp_business_messaging yet, so Embedded Signup would not offer those permissions to a customer at all and every call against the account they just created would answer error 200. Business Verification and Access Verification (Tech Provider) are both already granted — this is the only one outstanding.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set WHATSAPP_ES_ADVANCED_ACCESS=1 once the two WhatsApp permissions read live on GET /{app-id}/permissions — no deploy needed beyond the env var. Verify with that Graph call rather than the dashboard, which shows the submission rather than the grant.
Telegram
Post to a channel, group or chat as your own bot, and read replies. 4096 characters of text, 1024 with media. Telegram cannot list a bot’s chats, so you name the destination.
PostScheduleCarouselVideoMessagesDelete
- Key
telegram- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Bluesky
Post as your account — 300 characters, plus EITHER up to 4 images OR one video, never both (video needs a confirmed email). DMs too: 1000 characters, text only.
PostScheduleImagesVideoDMsDelete
- Key
bluesky- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Threads
Publish text, image or video posts, repost anyone, read how they performed, reply to and hide replies, search Threads. Threads has no edit — only delete and repost.
PublishRepostInsightsRepliesSearchDelete
- Key
threads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
YouTube
Publish videos to your channel — public, unlisted or private — then read performance and reply to comments.
PublishCommentsAnalytics
- Key
youtube- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
TikTok
Publish a video or photo post (up to 35 images) — live or into drafts, and read how each did. TikTok’s API can’t delete or edit a post once it’s up; that’s done in their app.
PostingPost statsFollower stats
- Key
tiktok- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
LinkedIn
Post to a company Page or your profile, run ad campaigns, read your lead gen form leads (real-time to Hermoso or your CRM) and answer comments. Your profile is off unless you turn it on.
PublishingCompany PagesAd campaignsLead formsComments
- Key
linkedin- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
X (Twitter)
Post, thread, poll or reply, read performance and mentions, answer DMs — X keeps only 30 days of them. X charges per API call, so every action costs credits.
PublishThreadsAnalyticsDMsMentions
- Key
x- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Snapchat approval pending
Publish a finished video to your Public Profile as a Story or a Spotlight, and group Snaps into a Saved Story. Video only — 5–60s for a Story, 6–60s for a Spotlight, 540x960 minimum.
StoriesSpotlights
- Key
snapchat- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Snapchat posting is NOT BUILT — there are no Story, Spotlight or Saved Story tools or routes in Hermoso, only an OAuth descriptor. Snap has also not allowlisted this app for the Public Profile API (their own words: "The Public Profile API is currently allowlist only"), so BOTH the code and the access are outstanding. Snapchat ADS is a separate connector and is fully built and live.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set SNAPCHAT_PROFILE_API_APPROVED=1 — but that is the SECOND of two steps and on its own it would offer a connector a user can authorize and then do nothing with. Step one is to build the publish path: Stories, Spotlights and Saved Stories have no tools and no routes today. Step two is Snap allowlisting the client id (a request to a Snap point of contact, who enables it against the OAuth app); no deploy is needed beyond the env var. snapchat_ads is unaffected either way.
Reddit approval pending
Post to a subreddit, read and answer the comments, edit a text post’s body or delete it. One subreddit at a time — Reddit bans cross-posting. Titles can never be edited.
PublishCommentsEditDelete
- Key
reddit- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Reddit has not approved API access for this app yet (approval ticket, not a credential).
Everything above is built and tested; what is missing is the platform's approval, not the code. Set REDDIT_API_APPROVED=1 alongside REDDIT_CLIENT_ID/REDDIT_CLIENT_SECRET once the ticket is granted.
Pinterest
Publish image and video Pins to a board you pick, edit or delete Pins and boards afterwards, and read how each one did.
PublishBoardsEditDelete
- Key
pinterest- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Google Business Profile approval pending
Post updates, events and offers to your Google Search & Maps listing, and read the calls, clicks and directions they drive.
PublishOffersInsights
- Key
google_business- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. Google has not allowlisted the Business Profile API for this project yet — every Business Profile API reads 0 QPM, so locations, insights and Q&A 403 alongside posting and reviews.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set GOOGLE_BUSINESS_API_APPROVED=1 once Google grants the project access — no deploy needed beyond the env var. The other two steps are already done: the v1 APIs are enabled, and the business.manage scope is declared (2026-08-19). On grant day also run `gcloud services enable mybusiness.googleapis.com`, which is what posting and reviews need.
Advertising
Meta
Facebook & Instagram posts, ads, comments and DMs (Messenger + Instagram Direct, message requests included). A Page-less Instagram account uses the Instagram connector. Posts can never be edited.
FacebookInstagramAd campaignsLead formsInsightsCommentsDMs
- Key
meta- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Google Ads
Campaigns, budgets and reporting for Google Ads. New campaigns start paused, so nothing spends until you enable them.
ReportingCampaignsBudgets
- Key
google_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Microsoft Ads
Campaigns, ad groups, search ads, keywords, budgets and reporting on Bing.
ReportingCampaignsBudgets
- Key
microsoft_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Apple Ads
App Store search ads and Ads on Apple Maps, all created PAUSED. An App Store ad renders from your App Store Connect page, not an image you upload; a Maps ad uses your own image.
CampaignsKeywordsReportingCreatives & adsApple Maps brands
- Key
apple_ads- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
ChatGPT Ads
Ads inside ChatGPT — the sponsored card under an answer. Campaigns, budgets and reporting; one format only, a text + image card, no video.
ReportingCampaignsBudgets
- Key
openai_ads- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
LinkedIn
Post to a company Page or your profile, run ad campaigns, read your lead gen form leads (real-time to Hermoso or your CRM) and answer comments. Your profile is off unless you turn it on.
PublishingCompany PagesAd campaignsLead formsComments
- Key
linkedin- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
TikTok Ads
TikTok ad campaigns, budgets and reporting.
Ad campaignsReporting
- Key
tiktok_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Snapchat Ads
Snapchat campaigns, ad squads, budgets and performance. Headlines run up to 34 characters.
Ad campaignsReporting
- Key
snapchat_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Reddit Ads
Reddit ad campaigns, ad groups, budgets and reporting.
Ad campaignsReporting
- Key
reddit_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
X Ads
X (Twitter) campaigns, line items, promoted posts, targeting and reporting.
Ad campaignsReporting
- Key
x_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Pinterest Ads
Pinterest campaigns, ad groups, budgets and reporting, promoting Pins that are already live.
Ad campaignsReporting
- Key
pinterest_ads- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Analytics
Google Analytics
GA4 traffic, conversions and realtime activity by channel, campaign or landing page, plus key events and custom dimensions. Only properties you tick are readable.
ReportsRealtimeProperties
- Key
google_analytics- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Google Tag Manager approval pending
Your site’s analytics and conversion tags. Audit what is live and stage new ones — nothing Hermoso writes reaches a visitor until you publish the container.
Tag auditConversion tagsTriggersPublish
- Key
google_tag_manager- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. GOOGLE_TAG_MANAGER_SCOPE_DECLARED is unset in THIS environment. Note this is no longer a paperwork blocker: all three Tag Manager scopes — `tagmanager.edit.containers` (read + stage), `tagmanager.edit.containerversions` (turn a workspace into a version) and `tagmanager.publish` (make that version live) — are declared on the consent screen and were APPROVED by Google OAuth verification on 2026-08-20 for project 209678518568. They are SENSITIVE (measured 2026-08-19), which is why that submission was needed; approval makes them usable, not non-sensitive.
Everything above is built and tested; what is missing is the platform's approval, not the code. Set GOOGLE_TAG_MANAGER_SCOPE_DECLARED=1 — no deploy needed beyond the env var, and it is ALREADY SET ON PROD (revision hermoso-00997-qn2), so if you are reading this the environment you are in is not production. Both prerequisite steps are DONE: all three scopes are declared on the Data Access page of ad-inspiration-499417 (the project that owns the OAuth client, settled by the numeric prefix 209678518568 and never by the project NAME) — https://www.googleapis.com/auth/tagmanager.edit.containers, https://www.googleapis.com/auth/tagmanager.edit.containerversions and https://www.googleapis.com/auth/tagmanager.publish — and Google approved the verification re-submission for exactly those three on 2026-08-20. The three had to be declared TOGETHER and were: the publish path calls workspaces.create_version, which the vendor scopes to edit.containerversions ALONE, and versions.publish, which it scopes to publish ALONE, so a submission for publish without containerversions would have shipped a publish path that 403s on its first call and cost a second demo video. The Tag Manager API was enabled on that project 2026-08-19, which is a prerequisite for the scopes to be selectable at all.
Google Search Console approval pending
Impressions, clicks, CTR and position for the organic traffic Google sends you — the one place real search terms still exist. Plus per-page index status and sitemaps.
Search termsIndex statusSitemaps
- Key
google_search_console- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Not offered yet. GOOGLE_SEARCH_CONSOLE_SCOPE_DECLARED is unset, so the connector is held back even though the `webmasters` scope is now declared on the consent screen (2026-08-19).
Everything above is built and tested; what is missing is the platform's approval, not the code. Set GOOGLE_SEARCH_CONSOLE_SCOPE_DECLARED=1 — no deploy needed beyond the env var, and it is already set on prod. The two prerequisite steps are DONE: https://www.googleapis.com/auth/webmasters is declared on the Data Access page of the project that owns the OAuth client (non-sensitive; it did not re-trigger verification), and it is in the declared table in tools/google-scope-parity-check.mjs so the two sides cannot drift.
Bing Webmaster Tools
Bing search terms, clicks and position, crawl issues and inbound links — plus keyword research with real impression volumes and no ad spend. Bing also feeds Copilot.
Search termsKeywordsCrawl
- Key
bing_webmaster- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
HubSpot
Your CRM: read and search contacts, create or update one by email, push Meta and LinkedIn lead-form leads in as contacts without twins, and report deals by stage, source and month.
ContactsLead syncDeals
- Key
hubspot- Linked by
- OAuth — the user approves it in a browser. An agent cannot link a new account; it can only use one already linked.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Stripe
Revenue, refunds, customers, subscriptions and MRR from your own Stripe account, plus products, prices, payment links, coupons and refunds created from here. Live-account writes confirm first.
RevenueCustomersSubscriptionsProducts
- Key
stripe- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
PostHog
Per-user funnels, retention and session replay — the questions GA4 cannot answer. Replays come back as links you open in PostHog.
HogQLInsightsSession replay
- Key
posthog- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Mixpanel
Retention cohorts, event breakdowns and the events a project actually records — plus any saved Mixpanel report, read straight back by its id.
InsightsRetentionEvents
- Key
mixpanel- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.
Amplitude
Event segmentation, funnels with a conversion window, retention curves, and one person’s full activity stream — found by user id, device id or just the start of one.
FunnelsRetentionUser activity
- Key
amplitude- Linked by
- Pasting a credential in the app.
- Scope
- Shared with the whole brand workspace — teammates can use it, and only the person who authorised it can disconnect it.