Business systems

Pick the authentication method your deployment can actually issue. The Authentication method select changes which fields appear; the ones the other methods use are hidden, are not required, and are dropped when you save.

• Cloud — account email + API token. A *.atlassian.net site. The default.
• Server / Data Center — personal access token. Self-hosted. These instances cannot issue Atlassian API tokens at all, and take a bare bearer token with no email beside it.
• Cloud — pre-issued OAuth 2.0 access token. For someone who already mints access tokens out of band.

Create the credential.

Cloud: an API token at id.atlassian.com → Security → API tokens. One token works for both products. It acts as the Atlassian account it belongs to, so use an account whose Jira and Confluence permissions are read-only.

Server / Data Center: a personal access token from the account's own profile, under Profile → Personal Access Tokens → Create token, in each product. Jira needs 8.14 or newer, Confluence 6.0 or newer; older versions have no such screen and cannot use this method. The token carries that account's permissions, so create it under a read-only account. There is no email field to fill in; a bare token is the whole credential.

Pre-issued OAuth token: paste a token you already hold, plus the site's cloud ID. Read it from api.atlassian.com/oauth/token/accessible-resources called with that token. It is a UUID, not the site URL.

Fill in one or both product blocks.

Filling an email or token without its URL does nothing. The product stays off.

Verify. Start-checked only: every search tool requires a query, so there is no fixed call to health-check with.

Create a restricted key. dashboard.stripe.com/apikeys → Create restricted key, granting Read on: Balance, Customers, Products, Prices, Invoices, Coupons, Payment intents, Subscriptions, Disputes. Nothing write.

Mind the mode: a test-mode key can't see live data.

Fill the form.

Verify. Health check retrieves the account balance.

Create a Slack app at api.slack.com/apps → From scratch, in the workspace you want searchable.

Add user token scopes under OAuth & Permissions → Scopes → User Token Scopes: search:read (the reason this integration exists), plus channels:history, channels:read, groups:history / groups:read for private channels, users:read (looking up who posted), and usergroups:read (resolving @team mentions).

If you intend to turn on Allow posting messages below, also add chat:write. Without it the posting tool is registered but every post fails with missing_scope. Leave it off the token for a read-only setup, so the scope list matches what the integration can actually do.

Install the app to the workspace and copy the User OAuth Token (xoxp-…). Invite the token's user to any private channels you want readable.

Fill the form.

If the connection is inspected on the way out, the token isn't the problem, the certificate is. A corporate TLS-inspecting proxy re-signs slack.com with its own CA, which the server does not trust, so put an absolute path to that CA's PEM bundle in CA certificate path and the proxy's address in Proxy URL. Your network team has both.

A password in the proxy URL is stored encrypted like any other field on this form, and is stripped from the connection target shown in the UI.

Verify. Health check lists one public channel. On a very large workspace the first attempt can land before the server's channel cache is warm; it fails closed and recovers on the next sync.

Create an internal integration at notion.so/profile/integrations. Under Capabilities, select Read content and nothing else.

Copy the Internal Integration Secret (ntn_…). The integration's own ID is not a token.

Connect it to the pages you want readable. In Notion, open the page (or the parent of a whole space), then ••• → Connections → add the integration. Nothing is visible to it until you do this; sharing is per-page and it is the step people miss.

Fill the form.

Verify. Health check reads the integration's own bot user, so it fails exactly when the token is wrong. Note that it passes even when nothing has been shared yet.

Enable API token access. Admin Center → Apps and integrations → Zendesk API, turn on token access, then Add API token. Copy it; it's shown once.

Note the agent email the token was created under. The two are paired; a mismatch is a 401.

Fill the form.

Verify. Health check lists organizations, which exercises all three fields.

Pick the authentication method the instance can issue. The Authentication method select changes which fields appear; the ones the other methods use are hidden, are not required, and are dropped when you save. Read-only is enforced on Triagic's side under all four.

• Basic — username + password. The default, and the one every instance supports.
• OAuth 2.0 — client credentials. The token belongs to a registered application rather than to a person.
• Inbound API key. A key scoped by an inbound authentication profile.
• Pre-issued bearer token. A token you already hold. Nothing here refreshes it.

Create the credential.

Basic: a service account with REST API access and a read-only role. itil is enough to read incidents and changes; snc_read_only or a custom read role is the least-privilege option. The account must not be locked out, and must not be an interactive-only user; instances often block those from the REST API.

OAuth: System OAuth → Application Registry → Create an OAuth API endpoint for external clients. Copy the Client ID and Client Secret from the record. Triagic uses the client credentials grant, the only one of ServiceNow's four that runs without a browser. So grant the application itself read-only access, because there is no user behind the token whose roles would limit it.

Inbound API key: System Web Services → API Key. It goes out as the x-sn-apikey header and reaches only the endpoints its inbound authentication profile allows, so the profile is where you narrow it.

Bearer token: paste one you already hold.

Fill the form.

Verify. Health check lists tables, which fails on a bad URL, a rejected credential, or a user without table visibility.

Create a personal API key. In Linear, open Settings → Account → Security & access → New API key. Set the permission to Read and, if you want, limit it to the teams the agent should see. Copy it; it's shown once.

Fill the form.

Verify. Health check lists teams, which fails on a bad or revoked key.

Get an access token. In Intercom's Developer Hub, open or create an app for your workspace, then Configure → Authentication. Edit its permissions down to Read conversations, Read and list users and companies, and article read if you want Help Center search. Copy the access token.

Fill the form.

Verify. Health check lists companies, which fails on a bad token or the wrong region.

Create a Service Key. In HubSpot, open Settings → Integrations → Service Keys and create one with read scopes: crm.objects.contacts.read, crm.objects.companies.read, crm.objects.deals.read. Add tickets only if you want ticket lookups; HubSpot's tickets scope also allows writes. An existing private app's access token (pat-…) works too, but HubSpot is retiring new private apps.

Fill the form.

Verify. Health check lists one contact, so the key needs crm.objects.contacts.read.

Create the app. Setup → External Client App Manager → New External Client App (a Connected App works the same). Turn on OAuth, add the api scope, and enable the Client Credentials Flow.

Pick the run-as user. In the app's policies, set Run As to an integration user with API Enabled and read-only access to the objects you want triaged. Every query runs as this user.

Copy the consumer key and secret from the app's OAuth settings. New apps can take a few minutes before the first token request succeeds.

Fill the form.

Verify. Health check searches the object list for Case, which needs a working login and nothing else.

Pick the agent. Ideally a dedicated agent with a custom role limited to viewing tickets, contacts and solutions (custom roles need the Pro plan or above).

Copy its API key. Signed in as that agent: profile picture → Profile settings → View API key.

Fill the form.

Verify. Health check reads the current agent (/agents/me), which fails on a wrong domain or key.