Adding an integration¶
Status: Current | Last reviewed: 2026-09-09
Integrations connect TrueServe to outside systems — Amazon, Google, Microsoft, Salesforce, Genesys, Five9, Deepgram, OpenAI, Maven AGI, and so on. You add an integration once per tenant; agents and workflows then pick from it without ever seeing the credentials.
The catalog is organized by source. A source is the high-level platform that owns the credentials. Each source can expose one or more capabilities such as LLM, Telephony, OCR, Events, PII Redaction, Speech to Text, Text to Speech, CRM, Storage, Avatar, Teams, or Turn Control. Capabilities control which extra fields are shown on the integration form and which dropdowns the integration appears in elsewhere.
Add an integration¶
- From the left nav, open Integrations.
- Click New integration.
- Pick the source from the catalog.
- Turn on the capabilities this integration should provide. For example, an Amazon source can be used for Bedrock LLMs, Connect telephony, Textract OCR, Comprehend PII redaction, EventBridge events, SageMaker machine learning, SMS, or storage. Enable only the capabilities this saved credential profile should serve.
- Give the integration a name — short and descriptive ("Acme Salesforce Prod").
- Fill in the source and capability-specific form:
- OAuth integrations (Salesforce, Genesys) — click Connect and complete the OAuth flow in a popup. TrueServe stores the resulting refresh token encrypted.
- API-key integrations (OpenAI, Deepgram, ElevenLabs, etc.) — paste the key. TrueServe encrypts it before saving; nobody, including administrators, can read it back.
- Amazon — enter an access key pair and region, or leave credentials blank when the TrueServe runtime role has AWS access. Fill AWS Session Token only if you are using temporary STS credentials — it expires, and when it does everything signing an AWS request with this integration stops working at once. When Telephony or Events is enabled, click Discover AWS resources to turn supported manual fields into dropdowns.
- Google — upload or paste the service-account JSON. The browser reads the file locally to fill the project ID before saving. When Events, Storage, or OCR is enabled, click Discover Google resources to list Pub/Sub subscriptions/topics, BigQuery datasets, GCS buckets, and Document AI processors.
- Microsoft — enter the Azure region, endpoint, and the keys for the enabled capabilities. When LLM, OCR, Text to Speech, or Avatar is enabled, click Discover Azure resources to list Azure OpenAI deployments, Document Intelligence models, and Speech voices.
- Maven AGI — enter the organization ID, app ID, app secret, and any optional base URL or discovery agent ID your Maven administrator gives you.
- Krisp VIVA — paste the API key and add the model paths your runtime will use for voice isolation, turn detection, interruption prediction, and VAD.
- OAuth2 API — a generic source for any HTTP API secured with OAuth 2.0 client credentials. Enter the API base URL (credentials are only ever sent to this origin), token endpoint, client ID and secret, and optional scopes/audience. Tools authenticated against it get a live Bearer token minted at call time — no stored token to expire or rotate by hand. This is the source capability-pack tools (for example adverse-event reporting) authenticate with.
- Username/password integrations — both fields are encrypted at rest.
- Click Test connection. The form makes a no-op call against the integration to confirm credentials work.
- Save.
The integration is now available to anyone in your tenant who has the Manage Agents or Manage Workflows permission. It appears only in pickers that match one of its enabled capabilities.
The Integrations page lists all saved integrations in one table. Use the Type column to scan the high-level source, and use Capabilities to see where that integration will appear elsewhere.
You can create more than one integration for the same source. For example, keep separate Amazon integrations for Bedrock and Connect if they use different credentials, regions, or operational ownership.
Per-provider notes¶
| Provider | Notes |
|---|---|
| Salesforce | OAuth with the External Client App your admin set up. Pick the right org type — Production vs Sandbox is selected separately. Agentforce is opt-in per integration: turn on Enable Agentforce only when the org actually has Agentforce provisioned — flipping the switch runs a live access check ("N agents found" or a warning if the org has no access), and the Agentforce agent pickers plus the Platform Events topic browser stay hidden until it's on. For Agentforce Voice, TrueServe normally discovers runtime connection info from Salesforce. If Salesforce gives your admin a Runtime Base URL, it can be entered in the optional Agentforce runtime URL field; TrueServe treats bot-runtime-api...sfdcfc.net values as Salesforce SDK apiEndpoint metadata and uses the shared Agentforce API host automatically. The ForceConfig Endpoint should match the Salesforce org URL on the integration. Leave Agentforce Tenant ID blank unless Salesforce gives you a specific value; TrueServe derives core/prod/<OrganizationId> by default. |
| Genesys Cloud | OAuth via Genesys's authorization code grant. Pick your region from the dropdown — wrong region returns a misleading "invalid client". |
| Genesys (telephony / BYOC) | Set the Organization ID, region, and the SIP / AudioHook / API details for the modes you use. The External Consults section is where you turn on external consults for the tenant and set the Routing Number — the single number every External Consult dials through (per-destination queue/DNIS routing rides the SIP headers). Agents with External Consult enabled use this number automatically. |
| Amazon | Turn on the capabilities you need: LLM for Bedrock, Telephony for Connect, OCR for Textract, PII Redaction for Comprehend, Events for EventBridge, Machine Learning for SageMaker, SMS, or Storage. For Connect, add the AWS region and the Connect Instance ARN; TrueServe derives the instance ID from the ARN. Static AWS credentials are optional; leave them blank when the TrueServe runtime role already has permissions. See Discovering AWS resources for what the Discover AWS resources button fills in. The outbound fields — Outbound Contact Flow ID, plus Outbound Source Phone Number or Outbound Queue ID — are what let TrueServe ask Connect to place a call, and they now drive two features: a workflow's Start Conversation node on the voice channel, and External Consult on a Connect call. Unlike Genesys there is no External Consults switch and no Routing Number on Amazon: consult is available as soon as those fields are set, the specialist's number is dialed directly, and a missing field is reported by name in the agent's own words to the caller rather than failing silently. Two requirements live in Connect rather than here — the outbound contact flow must transfer the answered call back to TrueServe over your Chime SDK Voice Connector (the external-transfer kind), and the credentials need permission to start and stop outbound contacts. |
| Use a service account with the API permissions for the capabilities you enable. Discover Google resources lists Pub/Sub subscriptions and topics for Events, BigQuery datasets and GCS buckets for Storage, and enabled Document AI processors for OCR. Selecting a discovered option can also fill related fields, such as a subscription's topic ID, a BigQuery dataset location, or a Document AI processor location. | |
| Microsoft | For Azure OpenAI, enable LLM and enter the Azure OpenAI API key plus the *.openai.azure.com resource endpoint. Model values are deployment names and must exist on this resource. The shared Azure Subscription Key remains for Speech and Document Intelligence. Discover Azure resources lists OpenAI deployments, Speech voices, and Document Intelligence models. Storage discovery is not listed because it requires management-plane credentials. |
| Five9 | Per-region credentials. The TrueServe instance must be allowlisted in Five9's CIDR list — your Five9 administrator does that. |
| OpenAI | API key. Set per-organization if your OpenAI account has multiple. |
| Anthropic | Native Anthropic API key. Claude Code Assistant Agent stages can also use AWS integrations for Bedrock or Google integrations for Vertex AI, so create the integration that matches where your Claude usage is billed. |
| AWS / Bedrock | Use an Amazon source with LLM enabled. Bedrock OpenAI-compatible agent stages require Bedrock API Key plus region; this bearer key is distinct from the standard AWS credentials used by SigV4 services such as workflow File Analysis. GPT-OSS 120B/20B are text-only choices; GPT-5.6 Luna/Terra/Sol also support vision. |
| Google / Vertex AI | Use a Google source with a project ID and service-account JSON that can invoke Vertex AI Claude models. You can upload the JSON key file in the integration form; the browser reads it locally and fills the project ID before saving. Claude Code stages route through Vertex when you pick a Google profile with the LLM or Assistant Agent capability. |
| Deepgram | API key. Default project is fine unless you've split STT and TTS budgets. |
| ElevenLabs | API key + voice library access. |
| Maven AGI | Organization ID + app ID + app secret. Optional Base URL is for non-default Maven environments. Optional Discovery Agent ID is used only for listing agents when Maven requires an agent header before a stage has been selected. |
| Krisp VIVA | API key plus local model paths. Agents use it only when a node's Turn Control selects a Krisp option; otherwise the runtime keeps native or Pipecat turn handling. |
| OAuth2 API | Client-credentials grant only. The API Base URL doubles as the origin allow-list: a tool call to any other origin will not carry this integration's auth (add Extra Allowed Origins, comma-separated, when one credential legitimately serves several hosts). Token responses are cached until just before expiry. |
| Microsoft / Azure Avatar | Use a Microsoft source with Avatar enabled for Azure TTS Avatar. Use a BeyondPresence source with Avatar enabled for Bey avatar sessions. |
Custom HTTP OCR, Presidio, and LiteLLM Proxy are no longer available as integration sources. Reconfigure any old workflows or agents that depended on them to a supported source capability.
Discovering AWS resources¶
On an Amazon integration with Telephony or Events enabled, Discover AWS resources uses the credentials and region already in the form to look up the real ids, so you can pick from a list instead of copying UUIDs out of the AWS console.
| Field | Filled with |
|---|---|
| Connect Instance ARN | Every Connect instance in the region. Picking one also sets the region. |
| Default Contact Flow ID | The instance's contact flows. |
| Outbound Contact Flow ID | The same flows — the one Connect runs whenever TrueServe asks it to place a call, for a workflow's voice Start Conversation node and for External Consult alike. |
| Outbound Queue ID | The instance's standard queues. |
| Outbound Source Phone Number | The phone numbers claimed to the instance, shown with their descriptions. |
| Chime Voice Connector ID | The Voice Connectors in the region. |
| Adapter Queue URL / ARN | Your SQS queues (with Events enabled). Picking one fills the other. |
Two things to know:
- Set the Connect Instance ARN first. Contact flows, queues, and phone numbers all belong to an instance, so they can only be listed once TrueServe knows which one. Pick or paste the ARN, then click Discover AWS resources again. If the account has exactly one instance, TrueServe uses it without being told.
- Every field stays typable. The box under each dropdown always holds the saved value, so you can enter an id by hand — useful when your AWS credentials are not allowed to list that resource type, or when a Voice Connector lives in a region that has no Chime SDK Voice endpoint. Anything the button cannot list is reported as a warning naming that one resource type; the other dropdowns still fill in.
Reconnecting / rotating credentials¶
OAuth refresh tokens expire eventually. TrueServe surfaces a banner on the integration when its token can no longer refresh — click Reconnect and re-do the OAuth flow.
API keys rotate manually: edit the integration, paste the new key, save. The old key is overwritten.
For Amazon, rotate AWS Access Key ID, AWS Secret Access Key, and AWS Session Token together. All three are stored encrypted and none can be read back, so on edit each one shows Leave blank to keep unchanged — an empty box means "keep the saved value", not "delete it". To change a key, type the new one and save.
Saved credentials cannot be removed from the editor — clearing a box keeps the stored value rather than deleting it. If an integration should stop using static credentials and fall back to the TrueServe runtime role, create a replacement integration with those fields left empty and repoint whatever uses it. The emulator's Connect proxy uses the runtime-role fallback only after it verifies an active Amazon Connect integration in the current tenant, so disabling or deleting the integration disables the proxy path.
For Salesforce Agentforce Voice, rotate normal Salesforce credentials as usual. Only change the Agentforce runtime URL when Salesforce support or your org administrator gives you a replacement Runtime Base URL. Leave Agentforce Tenant ID blank unless Salesforce gives you a value that differs from the Organization ID-derived tenant GUID.
For Maven AGI, rotate the app secret from the integration editor. Existing stages keep their selected Maven agent IDs; the next chat or voice session uses the new secret automatically.
Removing an integration¶
You can only delete an integration that no agent or workflow references. The deletion dialog shows a list of dependents if any exist — fix or remove those first.