Connectors Overview
Continuously ingest third-party sources into CortexDB — self-hosted with cortexdb-sync, or managed. The shared mechanics for all 18 connectors.
Connectors keep CortexDB in sync with the systems your team already uses — chat, tickets, docs, code, CRM. There are 18 connectors, and every one runs two ways:
- Self-hosted (recommended) — the
cortexdb-connectorspackage ships acortexdb-syncCLI you run yourself against your own CortexDB instance. Nothing leaves your infrastructure, and it's the path documented on each connector page and below. Point it athttp://localhost:3141(or your server's URL) and it ingests into your scopes. - Managed — alternatively, CortexDB can run the connector as a worker on its infrastructure; configure it once from your dashboard and it handles webhook registration, retries, backfill, and idempotency.
Install the CLI
pip install cortexdb-connectorsThis provides the cortexdb-sync command with six subcommands:
| Subcommand | What it does |
|---|---|
sync <connector> | One-shot sync. |
watch <connector> --interval N | Sync forever with a sleep between cycles. |
serve | Run the webhook receiver for real-time create/update/delete. |
status | Show cursor state for every connector. |
list | List available connectors and their required env vars. |
auth | Show the resolved CortexDB credentials (redacted). |
Add a connector's optional extra to pull its dependencies, e.g. pip install 'cortexdb-connectors[slack]'.
Point it at your instance
The CLI defaults to the cloud — override for self-host
cortexdb-sync targets the cloud API by default. For a self-hosted server, pass --api-url (or set
CORTEXDB_URL) to your instance, e.g. http://localhost:3141.
CortexDB credentials resolve in precedence order: CLI flags → environment → ~/.cortexdb/state.json
(written by cortexdb init). The relevant global flags:
cortexdb-sync \
--api-url http://localhost:3141 \
--api-key <PASETO-or-CORTEX_API_KEY> \
--actor user:alice \
--scope-template "org:acme/source:slack/channel:{channel}" \
sync slackcortexdb-sync auth prints the resolved (redacted) credentials so you can confirm what it will use.
Configure a source
Each connector needs its third-party credentials. Two ways to supply them:
- Environment variables — run
cortexdb-sync listto see exactly which are required per connector (they're therequired envcolumn on each connector page). - A YAML
--configfile keyed by connector slug — useful for selectors that aren't plain auth (e.g. Jira'sproject_keys, Teams'team_ids).
The scope template shapes where events land
--scope-template (or CORTEXDB_SCOPE_TEMPLATE) controls the scope each event is written to, with
per-connector placeholders like {channel}, {author}, {workspace}. See
Scopes.
Run modes
# One-shot: sync everything new since the last cursor, then exit
cortexdb-sync sync slack
# Watch: loop forever, sleeping --interval seconds between cycles
cortexdb-sync watch slack --interval 60
# Serve: receive real-time webhooks (create/update/delete)
cortexdb-sync serveCursor state persists in ~/.cortexdb/sync_state.json (per-connector), so re-running picks up where
the last cycle left off. --state-file overrides the location, and CORTEX_SYNC_STATE_PATH is the
environment equivalent — useful when the connector runs in a container with a mounted state volume.
(The packaged worker entrypoint reads SYNC_INTERVAL, default 300 seconds, for its own loop.)
Waiting for derived layers
Pass --wait-derivation to have a sync block until the derived layers catch up, rather than returning
as soon as events are captured. Derived layers (Facts/Beliefs) require enrichment on a self-host — see
Self-hosting defaults.
Webhooks (real-time)
cortexdb-sync serve runs a receiver for connectors that support push. Verification is per-connector:
some sources sign their payloads, while sources that don't (e.g. tl;dv) use a static shared secret
header instead. The receiver reads these environment variables:
| Env var | Default | What it does |
|---|---|---|
WEBHOOK_PORT | 8081 | Port the receiver listens on. |
SLACK_SIGNING_SECRET | — | Verifies Slack request signatures. |
GITHUB_WEBHOOK_SECRET | — | Verifies GitHub's X-Hub-Signature-256 header. |
JIRA_WEBHOOK_SECRET | — | Static shared secret for Jira deliveries. |
FRESHDESK_WEBHOOK_SECRET | — | Static shared secret for Freshdesk deliveries. |
TLDV_WEBHOOK_SECRET | — | Sent by tl;dv as Authorization: Bearer <secret>. |
A secret left unset defaults to empty, which disables verification for that source — set one for every connector you actually expose. Individual connector pages cover the webhook path and payload details.
Cross-connector notes
preceded_by is not set by any connector
Connector pages sometimes describe thread replies linking via context.preceded_by. No connector
sets preceded_by — a connector doesn't have the parent's CortexDB evt_… id at emit time. Instead
it attaches a thread=<source-specific-id> label, which you can filter recall by. This is corrected
on each page.
- Idempotency keys are per-connector and version-aware where the source supports edits (a
content-version or
updatedtimestamp segment lets an edit land as a new version rather than colliding). The exact shape is on each connector page. - Self-host auth may differ from the dashboard. Some connectors use OAuth apps in the managed dashboard but simpler token/password auth self-hosted (GitHub, Salesforce, ServiceNow). Each page notes both.
The 18 connectors
| Connector | Required env |
|---|---|
| Slack | SLACK_BOT_TOKEN |
| GitHub | GITHUB_TOKEN |
| GitLab | GITLAB_TOKEN |
| Jira | JIRA_URL, JIRA_EMAIL, JIRA_API_TOKEN |
| Freshdesk | FRESHDESK_DOMAIN, FRESHDESK_API_KEY |
| tl;dv | TLDV_API_KEY |
| Linear | LINEAR_API_KEY |
| Confluence | CONFLUENCE_URL, CONFLUENCE_EMAIL, CONFLUENCE_API_TOKEN |
| Notion | NOTION_TOKEN |
| PagerDuty | PAGERDUTY_API_KEY |
| Discord | DISCORD_BOT_TOKEN |
| Microsoft Teams | TEAMS_TENANT_ID, TEAMS_CLIENT_ID, TEAMS_CLIENT_SECRET |
| Google Workspace | GW_SERVICE_ACCOUNT_KEY, GW_DELEGATED_USER |
| Salesforce | SF_INSTANCE_URL, SF_CLIENT_ID, SF_CLIENT_SECRET, SF_USERNAME, SF_PASSWORD |
| HubSpot | HUBSPOT_TOKEN |
| Zendesk | ZENDESK_SUBDOMAIN, ZENDESK_EMAIL, ZENDESK_TOKEN |
| Intercom | INTERCOM_TOKEN |
| ServiceNow | SNOW_INSTANCE, SNOW_USERNAME, SNOW_PASSWORD |