Build an integration

Choose where it belongs

Your project

A feature your app’s users need, such as booking availability. Implement it in your app and its backend.

A Lyre plugin

A tool for the person building the app, such as a host-side deployment status panel.

A coding provider

A provider adapter when you need agent sessions, approvals and model selection—not merely an HTTP request.

Define the smallest useful request

Start with a read-only operation against a test account. Define a bounded input, the minimum output needed by the UI, a timeout and fixed error states. Validate the destination on the host; do not let a client send arbitrary URLs with a privileged API key.

Client: request a status by approved resource ID
Host: validate scope → load credential → call fixed service
Host: return a small status response
Client: render ready, unavailable or permission denied

Keep secrets server-side

Use the service’s narrowest suitable credentials and its documented authentication flow. Never return keys or raw provider errors through a plugin response. Avoid putting secrets in shared settings because those may be visible to clients.

Separate development and production configuration. For a public browser app, use a backend for secret-bearing requests. A key hidden in a frontend environment variable is still shipped to the browser.

Test before you write real data

• Invalid or expired credentials produce a useful, sanitized error.
• Wrong-project requests and unauthorized users are denied.
• Slow requests, rate limits, cancellation and disconnection are bounded.
• Retries do not duplicate writes; use the service’s idempotency mechanism where available.
• Removing the integration stops background work and releases resources.

For actions that publish, deploy, spend money or change data, show the exact action and obtain the required user approval. Keep a read-only mode for diagnosis.