The CLI exposes two integration commands: outlit integrations setup and
outlit integrations status. Both use the public tool gateway. Supported actor-owned setup uses
an API key with integrations:connect_own; workspace or admin setup uses
integrations:manage. Core determines which authorization route applies to each provider and
request.
Integration setup
Setup begins with a secretless capabilities request. When Core advertises
preferredSetupVersion: 1, the CLI continues through outlit_setup_integration. Older Core
deployments retain the browser-handoff compatibility flow; the CLI never sends credentials or
provider configuration to that fallback.
Interactive setup can:
- Prompt for a provider credential only after Core returns
CREDENTIAL_REQUIRED. Secret prompts
disable terminal echo.
- Open a validated browser handoff on the configured Outlit origin. Authentication handoffs are
polled for at most five minutes; recovery and external-setup handoffs are terminal.
- Display a CRM recommendation and submit that exact mapping after confirmation.
- Display a Mixpanel preview and submit the exact mapping selected by the user.
The state machine makes at most three setup calls. Repeated credential, authentication, or mapping
transitions stop with SETUP_STALLED instead of prompting indefinitely. If a validated URL cannot
be opened, the CLI prints it for the user without treating the setup response as a failure.
Setup has no provider-secret flags. Never place provider credentials directly in command-line
arguments, where process listings and shell history can expose them.
Automation and JSON mode
Use --config-stdin to opt into reading exactly one strict JSON object from stdin. Its shape is
provider-specific. For example, a Fireflies API key is supplied only through stdin:
An explicit HubSpot CRM mapping is likewise supplied as the generated CRM mapping shape:
The provider remains the positional CLI argument and is rejected inside the stdin document. Unknown
top-level fields are also rejected. --config-stdin is explicit; ordinary piped stdin is not read.
JSON mode never prompts, opens a browser, or polls. It returns the raw setup result for handoffs and
configuration previews. If credentials are required but were not supplied through --config-stdin,
the command exits nonzero with Core’s stable CREDENTIAL_REQUIRED error.
For a CRM recommendation, --accept-recommended submits the exact recommendation from the current
response. It conflicts with a custom CRM mapping supplied through stdin. A Mixpanel mapping must be
supplied as an exact, confirmed configuration in headless mode.
Expected provider credentials are never returned in command output. Handoff URLs must match the
configured Outlit origin, use HTTPS except for loopback development, and contain no URL credentials,
fragments, or secret-bearing query parameters.
Integration status
status calls outlit_get_integration_status and returns one of five configuration-readiness
states:
ready describes configuration readiness only. It does not promise that a sync or backfill has
finished, that customer data is present, or that provider data is current. The status command does
not expose browser-session, raw provider-state, sync, or action metadata. gmail is accepted as a
CLI alias for google-mail.
Release dependency
Deploy the matching Core public-tool contract before publishing this SDK release. Until then, keep
the SDK release on hold; the browser compatibility path is for older Core deployments, not a reason
to publish the new generated contract early. 
