Integrations (provider accounts)
Integrations (provider accounts)
The sidebar shows this page as Integrations. It holds your accounts at other providers: hosting companies, registrars, DNS hosts, a mail server and GitHub (module integrations). Connect an account and MaxSuite keeps an inventory of what is there, so nobody has to keep that list by hand. That covers servers, domains, DNS zones, mailboxes and repositories. Where the provider allows it and you say so, MaxSuite can also change things there: DNS records, nameservers, zone settings, mail domains and server power. The SMTP2GO screen sets up outbound mail for your mail domains.
In the sidebar under Connections → Integrations and Connections → SMTP2GO. Needs: Costs, Domains, Services. Credentials are encrypted on the way in and never come back out, to a person or to an agent.
Integrations
- The list of connected accounts: each with your label for it (and its last error, if any), the provider, who sees it and what MaxSuite may do with it. Each row also shows a state (active, paused or failing) and when it last synced. An account in red is failing, with the provider's error under its name.
- Counts at the top: how many accounts are connected, active and failing.
- Accounts shared with you: a colleague's private account shared with you shows as Shared with you with your role and whose account it is.
- Row buttons, for people who may manage integrations: Sharing (your own private accounts), Replace key, Test, Sync and Edit. An account can be removed.
Providers you can connect
The Provider picker says what each one gives. The form then asks for exactly the fields that provider needs: a token, a key and secret, a user name and so on.
| Provider | What a sync brings in | What MaxSuite can change there |
|---|---|---|
| AWS (Lightsail, Route 53 Domains) | Servers, DNS zones, domains | Nameservers of names registered at Route 53 |
| Akamai (Linode) | Servers | Power |
| Cloudflare | DNS zones | DNS records, new zones, zone settings, pausing the proxy, purging the cache, who can reach a zone |
| Contabo | Servers | Nothing: read only |
| DigitalOcean | Servers, managed databases, load balancers, volumes, Kubernetes clusters, apps | Power |
| GitHub | Repositories | Nothing: read only |
| GoDaddy | Domains | Nameservers |
| Hetzner Cloud | Servers | Power |
| Hostinger | Servers, domains | Power, nameservers |
| mailcow | Mail domains and mailboxes | Mail domains, mailboxes, aliases, mailbox passwords, outbound relay |
| Namecheap | Domains | Nameservers |
| OneProvider | Servers | Nothing: read only |
| OVHcloud | Servers, domains | Power (dedicated servers can only be rebooted), nameservers |
| Porkbun | Domains | Nameservers, DNS records |
| Scaleway | Servers | Power |
| Spaceship | Domains | Nameservers |
| Vultr | Servers | Power |
| WebNIC | Domains (you list them, because WebNIC's API cannot) | Nameservers |
Some providers only accept calls from addresses they know. Namecheap and WebNIC ask you to allow this server's public address at their end first.
What happens when an account syncs
A sync asks the provider what the account holds and folds the answer into the rest of MaxSuite:
- Domains from registrars, DNS hosts and the mail server go into Domains. Only the fields the provider is the authority for are overwritten. Your tags, project links, prices and hand-typed expiry dates stay. A hand-typed expiry gives way only to a later date from the registrar, which means a renewal.
- Servers and other billed things go onto Services on every sync. New ones are added, ones you typed in by hand are matched rather than duplicated, and ones the provider no longer lists are marked gone.
- Synced servers appear on the Infrastructure map, with how old each account's information is.
After a sync, a note says what changed: how many new rows on Services, how many matched, how many gone. It also names anything the provider refused to list, for example a token without database access.
SMTP2GO
Every domain on your mail servers and its standing at SMTP2GO, which sends their outbound mail once a domain is verified there. Each row shows the domain, its Mail server, and whether it is pending, verified or missing at SMTP2GO. Columns sort, and a Sends filter narrows the list.
- Set up adds a domain at SMTP2GO and writes its three DNS records (DKIM, return path and tracking) in the Cloudflare zone MaxSuite syncs. To do many at once, tick them and press Set up selected, or press Set up all for every domain not there yet.
- Verify asks SMTP2GO to check them now. It also checks by itself every ten minutes.
- Turn relay on makes verified domains send through SMTP2GO, and others follow as they verify. Turn relay off sends every domain directly again.
It needs the SMTP2GO API key stored as a secret named smtp2go under Named secrets, and for the relay its SMTP user as a secret named smtp2go-smtp. A mail server may have its own SMTP2GO account. The free plan holds five domains: Set up says so when SMTP2GO refuses another.
Amazon SES works the same way through the agent tools below. Its standing is shown on Mail → Sending domains.
What you can do
Connect an account
- Open Integrations and click Connect provider.
- Choose the Provider. Give it a Label, your own name for it. You can connect as many accounts at one provider as you like, each with its own label.
- Fill in the credential fields the form shows.
- Choose Who sees it: Only me keeps the account, and the domains and servers it lists, to you (administrators still see everything). Everyone here shares it with the workspace.
- Choose What Max may do: Read only, or Read and change. Changing DNS records, nameservers, zone settings, mail or server power needs Read and change.
- Save. MaxSuite asks the provider whether the credentials work before anything is stored.
Check, sync, edit or replace a key
- Test asks the provider whether the stored credentials still work and records the answer on the row.
- Sync pulls the current inventory now and says what changed.
- Edit changes its name, what Max may do through it, and whether it is on.
- Replace key asks only for the fields that changed (a blank field keeps what is stored), checks them with the provider, then syncs. Everything the account lists and everyone it is shared with stay as they were. A replaced connection takes over its old listings.
Pause or remove an account
Edit the row and untick Active to pause it. A paused account keeps its credentials and what it brought in, and is left out of the nightly sync. Removing an account deletes it and its credentials. The domains it listed stay, marked as no longer listed by anyone.
Share a private account's domains
Only an Only me account can be shared, by its owner or an administrator.
- Click Sharing on the row.
- Pick a person and a role, and optionally a date when it ends.
| Role | What the person gets, on every domain the account lists |
|---|---|
| Viewer | Sees the names |
| DNS editor | Also edits their DNS |
| Manager | Also sets their nameservers, and may sync the account |
A share covers domains a later sync brings in too. It never hands over the account itself or its credentials. See Sharing and visibility.
Change DNS, zones, mail and power
These are done by agents or through the API rather than from this page:
- DNS records at Cloudflare or Porkbun: list, add, correct and delete. This changes what the internet resolves. The DNS module only records what somebody believes is there.
- Zones at Cloudflare: create a zone, or create it and point the registrar at it in one step. Read and change the managed settings (
ssl,always_use_https,development_mode), pause the proxy and purge the cache. See who can reach a zone, invite a person to one domain, or take a person off. - Nameservers at a registrar: read them, or set new ones. A wrong list takes a domain off the internet, so read them first.
- Mail on a mailcow server: list, add and remove mail domains, mailboxes and aliases, create mailboxes such as contact@ and support@, and give mailboxes new passwords. Adding a domain generates its DKIM key, and a mail DNS plan lists the records the domain needs (MX, SPF, DKIM, DMARC, autodiscover). Nothing is published until you hand that plan to DNS.
- Outbound relay: set domains up at SMTP2GO or Amazon SES and route the mail server's outbound mail through them.
- Server power: reboot, power on or power off. Only these reversible actions exist. Nothing here can destroy, resize or rebuild a machine.
Who can do what
| Permission | Label | Lets you |
|---|---|---|
integrations:read | View integrations | See the accounts you may see, their inventory, DNS records, zone settings, nameservers, mail and the SMTP2GO screen. Share your own private accounts and see who has them. |
integrations:write | Manage integrations | Connect, edit, test, sync, replace keys, pause and remove accounts, set up SMTP2GO, and make changes at a provider through an account connected as Read and change. |
Somebody else's Only me account is invisible to you unless it was shared with you, and then you reach its domains, not the account. Services listed by a colleague's private account are hidden from you on Services as well. Administrators see every account. See People, roles and permissions.
What happens on its own
| Job | When | What it does |
|---|---|---|
nightly-sync | Every day at 04:00 UTC | Syncs every active account in every workspace. One failing provider does not stop the rest, and a failure shows as that account's last error. |
ses-status | Every 10 minutes | Checks each mail domain's standing at Amazon SES until it is verified, then once a day. |
smtp2go-status | Every 10 minutes | Checks each mail domain's standing at SMTP2GO. |
Needs
Costs, Domains and Services.
What agents can do
An agent can read the whole inventory, and make the same changes a person can through an account connected as Read and change. Reads run straight away. Every change waits for a person's approval by default. That includes syncing, DNS and zone changes, nameservers, mail, relays and power, each of which reaches a provider. See Agents and approvals.
Accounts and inventory
Read only: integrations.list, integrations.inventory, integrations.resources, integrations.servers, integrations.importable
Change: integrations.add, integrations.edit, integrations.sync, integrations.syncDomains, integrations.test, integrations.setActive, integrations.remove, integrations.importServices
integrations.add and integrations.edit take credentials from stored secrets by name, never typed keys. integrations.inventory totals what the workspace is running and what it costs per month, by kind. integrations.syncDomains refreshes only the accounts that carry domain names. integrations.importServices puts what has already been synced onto Services without asking the provider again.
Sharing
Read only: integrations.shares
Change: integrations.share, integrations.unshare
DNS records and zones
Read only: integrations.dnsRecords, integrations.zoneSettings, integrations.nameservers, integrations.zoneAccounts, integrations.zoneMembers
Change: integrations.createDnsRecord, integrations.updateDnsRecord, integrations.deleteDnsRecord, integrations.createZone, integrations.moveToZoneHost, integrations.updateZoneSetting, integrations.pauseZone, integrations.purgeCache, integrations.setNameservers, integrations.inviteToZone, integrations.removeFromZone
Agents are told to correct an existing record with integrations.updateDnsRecord rather than add a second one beside it. integrations.moveToZoneHost keeps the new zone if the nameserver step fails, so a half-done move can be finished. integrations.removeFromZone takes a person off the whole Cloudflare account, because that is how Cloudflare removes members.
Mail server
Read only: integrations.mailDomains, integrations.mailboxes, integrations.aliases, integrations.mailDnsPlan
Change: integrations.addMailDomain, integrations.removeMailDomain, integrations.addMailboxes, integrations.resetMailboxPasswords, integrations.removeMailbox, integrations.addAlias, integrations.removeAlias
Outbound relay
Read only: integrations.smtp2goStatus, integrations.smtp2goRelayPlan, integrations.sesStatus, integrations.sesRelayPlan
Change: integrations.smtp2goSetUp, integrations.smtp2goBackfill, integrations.smtp2goRelay, integrations.sesSetUp, integrations.sesBackfill, integrations.sesRelay
The backfill tools run set-up for many domains at once. They are a dry run unless told otherwise. The relay plan tools say what turning the relay on would change, before anything is changed.
Servers
Change: integrations.power
Over MCP the same tools are named integrations__list, integrations__power and so on. See API keys and MCP access.