Talks to the services you already use

Mollie

Let clients pay invoices online with iDEAL

Available

Connect the Mollie account your agency already has and every open invoice gains a payment link: iDEAL, Bancontact, cards, SEPA direct debit or PayPal, whatever your Mollie profile has switched on. The payer goes to Mollie's own checkout and what comes back here is an id, so schakl. never touches card data and carries no PCI scope. The confirmed payment becomes an ordinary payment line on the invoice, with nobody retyping it.

• Live or test is derived from the key's own prefix, never entered
• Payment methods are read back from Mollie, not configured a second time here
• An hourly reconcile repairs whatever a missed callback left behind

Connect your SnelStart administration and send it your clients, your issued invoices (with the PDF attached) and your articles. One thing comes back, and it is the thing SnelStart is authoritative about: who has paid. That payment lands in schakl. as an ordinary payment on the invoice, so everything downstream (status, reminders, the client portal) behaves exactly as it always has.

• One invoice never lands in the books twice, not even when the connection drops halfway
• The VAT kind comes from your own administration's rate table, not from an assumption
• A booking that was already there is adopted, never overwritten: your bookkeeper was right

Moving from the Timeon time registration to schakl. rarely happens in a day: for a while the team writes in both. This integration keeps hours and projects in step on both sides, in the direction you choose per kind, and first recognises what an earlier import already moved before it creates anything. An hour already on an invoice is never rewritten, and an hour changed on both sides goes to a queue instead of one of the two quietly winning.

• Pair first, create later: what already exists on both sides is recognised and not doubled
• A direction per kind: pull hours while projects go from schakl. to Timeon, or the other way round
• Invoiced hours are never overwritten or deleted; the difference is reported

Connect a Cloudflare account per client and manage the zone from the domain record itself: nameservers, the live DNS table, exports and one domain-wide redirect that schakl. creates and reads back. A domain marked as a redirect is now an actual Cloudflare Redirect Rule. The Registrar list separately answers which domains you pay to renew, and may therefore invoice.

• An existing zone is adopted first, and only then created
• Read and edit DNS live, export as a zone file or CSV
• If somebody changes the redirect in Cloudflare's own dashboard, schakl. reports it

OXXA

The register: expiry, lock, nameservers

Available

Reads your OXXA reseller register and puts expiry, transfer lock, autorenew, DNSSEC, the delegated nameservers and the registrant on the domain page. One action writes back: moving a domain's nameservers, which is what finishes the hand-off to Cloudflare. The first sync also shows which domains you are paying to renew that schakl. has no record of.

• Warns 60 days before expiry, and when a transfer lock is off
• Move nameservers from the domain page, with the Cloudflare pair one click away
• The first sync lays what you renew beside what schakl. knows, so what you pay for unknowingly stands out

One WordPress Application Password per website opens the same host several ways: the ordinary REST API, WordPress 6.9's Abilities API, the MCP server where that plugin is installed, and Rank Math's own AI Visibility route. The last of those supplies a marketing source: how often a brand is named and linked in AI answers. Under the same password an agent reads and edits the pages, media, forms and abilities of every connected site through the wordpress MCP section, with the site as a parameter rather than a tool of its own.

• The connection hangs off the website, not off the organisation: every client site has its own password
• Six independent probes on verify, and none of them decides the verdict of the others
• Rank Math AI Visibility as a marketing source: score, mentions, citations, sentiment and average rank

Uptime Kuma is the open-source monitor most agencies already run. Connect it and a monitor becomes a real record: with a client, a website, a profile, an activity trail and a place on the client page beside the domain and the hosting account it depends on. If the client's own Kuma sits behind a firewall it still works: the traffic simply runs the other way.

• Two kinds of connection: one we manage, and one that only reports to us
• Profiles instead of retyping the same settings three hundred times
• What we decided and what we last observed are stored apart, so drift is visible rather than silently overwritten

You register your own Google Cloud OAuth client as an Internal app, which is what makes the restricted Gmail and Drive scopes usable without Google's CASA assessment. Each employee then connects their own account: approved leave and planned tasks push into their own Google Calendar, the Drive panel opens the client's folder, and mail with a known contact lands on the client timeline once the mailbox owner approves it.

• Calendar: leave and tasks push one way to Google, Google events read from a cache
• Drive: browse and upload as yourself, a client folder built from your own template folder
• Gmail: only mail with a known contact, metadata first, the body only after approval

You register your own app in Microsoft Entra and each employee connects their own account. Approved leave and planned tasks push into their own Outlook calendar, the OneDrive panel opens the client's folder in your SharePoint library or OneDrive, and mail with a known contact lands on the client timeline once the mailbox owner approves it. The same three surfaces as Google Workspace, under the same rules, for an agency that lives in Microsoft 365.

• Calendar: leave and tasks push one way to Outlook, Outlook events read from a cache
• OneDrive: browse and upload as yourself, a client folder copied from your own template folder
• Outlook mail: only mail with a known contact, metadata first, the body only after approval

You link a GA4 property per client, on the client's own page. Every night the daily figures are pulled and stored in your own database, so the panel, the tab and the overview load without calling Google. The link runs on the Google connection a colleague already made, so there is no second login. Apart from the dashboard, Analytics is also an integration of its own: seventeen read routes over both GA4 APIs, as an MCP section of its own for an AI assistant.

• Sessions, users, new users, key events, engagement and revenue, stored per day
• A first link backfills roughly 13 months of history
• Drill-downs by top page, channel, device, key event and referring source

You link a Search Console property per client on the client's page, either a domain property or a URL prefix. Clicks, impressions, CTR and average position are stored per day, and the movers table shows which queries shifted against the previous period. Impressions in AI Overviews and AI Mode are something Google does not return through its API; they come in through the export of the Generative AI report. And apart from the dashboard, Search Console is a read surface of its own, for an AI assistant too: sitemaps, URL inspection, hourly figures and a free-form query. The same Google consent as Analytics and Ads, so no extra login.

• Clicks, impressions, CTR and average position, stored per day
• Top queries, top pages and the biggest movers
• Impressions in AI Overviews and AI Mode through Google's export button, as a tile, a trend and a report chapter

SE Ranking is the first marketing source that is not Google, and the connection shows it: it rides an API key for the whole agency instead of a per-employee grant. From a linked SE Ranking project, schakl. stores daily position figures for the dashboard and, per report, fetches the keywords, the latest site audit and the AI Result Tracker. On top of that it reads a client's AI Search overview from SE Ranking's Data API: how often ChatGPT, Perplexity, Gemini and Google's AI answers mention the brand and link to the site, last month against the month before.

• One key for the whole agency, stored encrypted under Instellingen → Marketing, with an optional second key for the Data API
• Stored per day: average position, top 3, top 10, top 30 and the number of ranking keywords
• AI Search overview: brand mentions, links to the site, average position and AI opportunity traffic, last month against the month before

You link a Google Ads account per client and see spend, clicks, impressions, conversions and conversion value beside the Analytics and Search Console figures. If you work from a manager account (MCC), the client accounts beneath it are expanded in the picker. On top of that Google Ads is a working screen of its own: read and change campaigns, search terms, negatives and budgets, with a per-client policy as a guard rail, from here or from an AI assistant. Besides the Google connection, Google Ads asks for one developer token from your agency.

• Spend, clicks, impressions, conversions and conversion value, stored per day
• Conversions are re-pulled for 30 days, so a month is only compared once Google has finished it
• A working screen with campaigns, keywords, search terms, negatives, devices, locations and recommendations

Half of an agency's marketing work is making the measuring happen: a conversion on a new form, an event on a quote request, a tag for the campaign that starts on Monday. Until now all of it happened in a browser tab schakl. knew nothing about. Link a client's container and you see what is live, who put it there and when, and which change has been staged for three weeks without ever being published.

• Editing and publishing are two separate permissions: a key can prepare the measurement without broadcasting it
• schakl. writes in a workspace of its own, so unfinished work never lands in the client's own draft
• What you created stays recorded: which tag and trigger together are "quote requested", set up from here, on a date, by a person

You put your own Anthropic key into Instellingen → AI (Settings → AI); it is stored encrypted and never played back. Every AI feature switches on and off on its own, from the assistant and the writing assist to e-mail into task and meeting minutes, and a monthly token budget with a live meter keeps the spend visible. For speech to text you pick a second provider alongside, because Anthropic does not transcribe.

• Your own key, encrypted per organisation, never played back
• Eight independently switchable features, each with its own model if you like; default model claude-opus-5
• Usage records counts only, never the text of a prompt or an answer

The same core as every provider: your own key encrypted per organisation, features that switch on and off independently and one monthly budget with a meter. The built-in default model is gpt-5. OpenAI can also do speech to text, so this lights up the microphone too: in Snel toevoegen (quick add) on Uren, for a new task, in the assistant and when recording a meeting.

• Your own key, stored encrypted, default model gpt-5
• Can also do speech to text: dictate hours, tasks and assistant questions, record meetings
• For meetings gpt-4o-transcribe-diarize, which says who spoke

Anything that speaks the OpenAI chat API on a base URL of your own: Azure OpenAI, Mistral, or an Ollama or vLLM in your own rack. The Basis-URL (base URL) field is mandatory for this provider; saving without it is a validation error on that exact field. Beyond that, the features, the budget and the meter work exactly as they do with a cloud provider.

• Azure OpenAI, Mistral, a local Ollama or vLLM: anything speaking the OpenAI chat API
• Base URL is mandatory here, for example https://ai.example.com/v1
• Can also do speech to text, if your server implements that endpoint; Mistral's transcription has a speech provider of its own

In schakl., Mistral is a speech provider: Voxtral turns a recording into text, in Dutch, with who spoke and when per segment. It takes three hours of audio in one request, which is why it is the provider we recommend for meetings: a recording that fits in one go keeps one set of speaker labels. The same key also works for dictation on Uren, for a task and in the assistant. For the chat features you pick another provider, or Mistral's chat API through OpenAI-compatible.

• Speaker labels and timestamps per segment, in Dutch
• Three hours in one request: a two-hour meeting is not cut into pieces
• Its own key, stored encrypted, separate from the chat key

Your team signs in with the account your agency already has: Google Workspace, Microsoft Entra ID, Authentik, Keycloak or Auth0. You configure the whole thing in-app, with no environment variables and no restart. If you want to go further, you switch password login off for the entire organisation.

• Discovery URL, client ID and secret per organisation; PKCE is always on
• Test the connection before you make anything mandatory
• An operator break-glass, so a broken provider can never lock you out

Two-factor verification works on its own: an authenticator app and ten single-use backup codes, with nothing to connect. Only the SMS fallback needs a gateway, and whoever runs the installation switches it on with one environment variable. Without it, the SMS option does not exist anywhere in the product.

• TOTP and backup codes need no integration; everyone enables them themselves
• One fixed JSON POST to a gateway of your own; Twilio, MessageBird or Spryng each need a small relay in front
• SMS always sits on top of the authenticator app, never instead of it

You pick the transport you already pay for: your own SMTP server, or Brevo, SendGrid or SMTP2GO over their own HTTP APIs. Everything the app sends — an invite, a password reset, an invoice, a quote, a reminder, a monthly report — leaves wrapped in your logo, brand name and colour, with your signature underneath. The name schakl. appears nowhere in it.

• Your own SMTP, or Brevo, SendGrid and SMTP2GO over their HTTP APIs
• One HTML signature, appended at the send seam to every outgoing mail
• Invoice, quote, reminder and report in your own words, per language

Files live on a Docker volume beside the database by default. Point the storage backend at s3 and the app writes new files to any S3-compatible bucket: Hetzner Object Storage, MinIO, Scaleway or AWS. Identical bytes cost one object per organisation, so the same signature logo on 500 received mails is one object rather than 500.

• Named volume or S3-compatible bucket, chosen at deploy time
• Files are addressed by their content: duplicates cost nothing after the first
• A nightly job folds legacy duplicates and reclaims unreferenced bytes

schakl. runs an MCP server at /mcp. Every /api/v1 operation is a tool there, generated from your own instance's OpenAPI spec and proxied in-process back to that same API. A tool call therefore passes through exactly the same gate as the web app: hostname to organisation, RLS bound, permissions resolved. Claude and ChatGPT connect with nothing but the address, over OAuth 2.1; other clients use an API key. Narrower addresses such as /mcp/compact and /mcp/google-ads offer part of the tools, for clients that cannot fit everything in their context.

• Every /api/v1 operation is a tool, named after the operation: list_companies, create_task, team_time_summary
• OAuth 2.1 with self-registration: Claude and ChatGPT connect with just the URL, and consent runs on your ordinary session
• You choose what a connection may do at consent: everything you may do, read only, or choose yourself

Everything the app does travels /api/v1: the web app never talks to the database directly, so there is no back door a script misses. The interactive reference sits on your own host at /api/docs, with the OpenAPI document at /api/openapi.json. You authenticate with an API key carrying exactly the permissions you tick.

• Swagger UI at /api/docs, ReDoc at /api/redoc, the document at /api/openapi.json (signed in, never public)
• Personal keys per employee, service accounts for integrations that keep running
• n8n is exactly this: an API key plus HTTP nodes, no separate connector needed