Connect a source

Two ways to connect

Every integration uses one of two auth styles (some offer both — the badge on each platform card above tells you which):

• One-click connect (OAuth) — you click Connect with X, sign in on the provider's own site, approve read access, and land back in Ploxir connected. Nothing to copy, and the provider can revoke access from their side at any time.
• Paste a key — you create a read-only API key / token in the provider's dashboard and paste it into Ploxir. Slightly more steps, but it works for self-hosted setups and lets you scope the key exactly.

Platforms with both flows (Stripe, Shopify, Square, HubSpot, Zendesk, and others) show a chooser: the one-click card first, a manual card underneath. If a one-click flow isn't active yet for a platform, the dialog says so and offers the manual path instead. A few sources need neither: the crypto wallet takes a plain address, the uptime monitor takes a list of URLs, and the webhook source generates a URL for you.

Ploxir only ever asks for read access. It never charges, or writes to, any connected account — the single exception is registering its own webhook receiver where the provider supports it (see the FAQ).

What happens when you connect

In order, at the moment you hit save:

1. Credentials are validated live. Ploxir calls the provider with your key/token before creating anything. A wrong key fails right there with the provider's error — you never end up with a source that silently doesn't work.
2. The source is named after the account. Where the provider exposes an account name, the source becomes e.g. "Stripe · Acme Inc" so two Stripe sources stay distinguishable. You can rename it anytime.
3. Credentials are encrypted at rest (AES-256-GCM) and never travel to the browser. See Security.
4. Real-time is set up where supported. For providers with webhook APIs, Ploxir registers its receiver automatically (list below). If registration fails, the source still works via polling — you get a warning chip and a notification instead of silence.
5. Starter widgets are seeded — up to four (the platform's headline KPIs plus one trend chart), so you land on data instead of an empty grid. Skipped for webhook and HTTP-JSON sources (their widgets only make sense once you define events or paths), and never duplicated on reconnect.
6. The first sync runs immediately. Widgets have data within seconds of connecting.

Real-time vs polled

How fresh your data is depends on the platform:

• Auto-registered webhooks — Stripe, Shopify, Patreon, Twitch, Paddle, Lemon Squeezy, PayPal, Beehiiv, Zendesk and Datadog. Ploxir registers its receiver with the provider on connect; events land on your dashboard within seconds.
• Paste-a-URL webhooks — RevenueCat, Gumroad, App Store (Server Notifications) and Play Console (Pub/Sub push) can't be registered automatically. Ploxir shows you the receiver URL; you paste it into the provider once (steps are in each platform's entry above). Until then those sources poll.
• Polling — everything else is pulled on a schedule: every 6 hours by default, every 2 hours for Datadog, Sentry and crypto wallets, every 24 hours for AdSense (its reports finalize slowly). Webhook-covered sources are also re-polled on the same schedule as a backstop, so a dropped webhook can't leave stale numbers forever.

The Refresh button in the dashboard toolbar (on both the workspace portfolio and every project page) shows how long ago the last sync ran and force-syncs everything in scope right now — the whole workspace from the portfolio, the project's sources from a project page. There's also a per-source Sync now button on each source row.

Source health at a glance

Each source row on the project's Sources page shows its widget count, when it last synced, and a live status chip:

• live (pulsing green) — credentials work, the webhook is registered with the provider, and events are actually arriving.
• webhook silent (amber) — the webhook is registered but no event has arrived in 7+ days. Either the account genuinely has no activity, or the provider silently stopped delivering. The Verify button asks the provider directly whether the webhook still exists and is enabled — and re-registers it automatically if it disappeared upstream.
• api broken (red) — the last sync failed. The error text is shown inline on the row, and a Reconnect button appears.
• webhook pending / webhook setup failed — auto-registration hasn't run yet, or it errored (the reason is shown on the row). The source keeps working via polling either way.

Reconnecting a broken source

When credentials die, don't delete the source. The red (or amber) Reconnect button on the source row reopens the connect flow and swaps the new key or OAuth grant onto the same source — every widget, its position, styling and accumulated history stay exactly where they were. Reconnecting requires Admin, same as connecting.

Once a credential is confirmed dead, Ploxir stops burning retries on it — syncing resumes automatically on the first successful reconnect.

Deleting a source

Deleting a source archives it and all of its widgets in the same instant — a widget never outlives its source, so you'll never see a tile silently rendering frozen data from a connection that no longer exists. The confirm dialog tells you exactly how many widgets go with it.

• For Connect-with-Stripe sources, reconnecting the same Stripe account to the same project later revives the archived source and its widgets automatically. For other platforms, reconnecting creates a fresh source — the archived one isn't destroyed, but its widgets don't come back on their own.
• Sources connected as an installed app (Connect-with-Stripe) say Disconnect instead of Delete — disconnecting also uninstalls Ploxir from your Stripe account.
• Deleting a project archives the project itself — its sources and widgets disappear from the dashboard with it.

FAQ

Who can connect, reconnect, or delete a source?

Admins and Owners. Editors can build widgets on existing sources, trigger syncs and use Verify, but can't touch credentials. Viewers are read-only. See Teams & roles.

Does Ploxir need write access to my accounts?

No. Every flow requests read-only scopes, and the per-platform steps above tell you the minimal set to grant. Ploxir never mutates a connected account — the one exception is registering its own webhook receiver where the provider supports it, which only affects where events are delivered.

Why are some of my Stripe widgets empty while others work?

Your restricted key is probably missing an optional scope. The core scopes (Charges, Customers, Subscriptions, Invoices, Refunds) power the revenue/MRR widgets; balance, payout, dispute, product and checkout widgets each need their own Read scope. Missing optional scopes don't break the sync — the dependent widgets just stay empty until you add the scope to the key.

My key expired / I rotated it. Did I lose anything?

No. The source shows red with a Reconnect button; widgets flag the problem instead of showing stale numbers. Reconnect with the new key and everything resumes in place — widgets, history, layout, all preserved.

I deleted a source by accident. Is my data gone?

The source and its widgets are archived, not destroyed — nothing is wiped at the moment you delete. For Connect-with-Stripe sources, reconnecting the same Stripe account in the same project revives the source and its widgets automatically. For other platforms, reconnecting creates a fresh source, so you'll rebuild widgets from the picker.

Can two projects (or workspaces) share one source?

No — a source belongs to exactly one project. Connect the same account separately in each project that needs it; each connection is independent, so revoking one never breaks the other. The workspace portfolio already merges matching sources across all your projects, which covers most "I want it in both places" cases without sharing anything.

How far back does my data go?

Stripe: all the way back to account creation (automatic backfill on connect). Everything else: forward from the day you connect, plus whatever window the provider's API exposes on each sync. Daily history points are kept for 400 days, and webhook events remain queryable over any date range you pick.

Why does my source say "webhook silent"?

The webhook is registered but nothing has arrived in over 7 days. If the account really had activity in that window, click Verify — it checks with the provider whether the webhook still exists and is enabled, and re-registers it if it vanished. If the account was genuinely quiet, the chip is just being honest.

The platform I need isn't listed. What now?

Use the Any platform (webhook) source — one URL that accepts any event stream your backend can POST — or Your own endpoint (HTTP JSON) to have Ploxir pull from any API that returns JSON. Both are documented above, and the webhook path in depth on the Webhooks page.