Settings → Developer settings → Personal access tokens. The
repo scope, or fine-grained with Contents and Administration: read and write.PLUG IT
IN!
Your GitHub, your Vercel, your Postgres. Connect them once and a published site can push to a repository, deploy to a project and save its forms in a database, all of them yours, from one dialog.
Home, signed in. The avatar opens the account menu and Integrations is chosen. The dialog lists GitHub, Vercel, Neon and Supabase, each with what it is for. Connect is clicked on Neon, a token is pasted (shown as dots) and Connect checks it: the Neon account appears under Neon. The same is done for GitHub, and its account appears under GitHub.
PLUG!
THE PROBLEM
Hosted for you is lovely, until it isn't
PopCraft hosts your site the moment you click Publish. Great for a launch page. Then someone asks where the code lives. Then the client wants it on their Vercel, at their domain. Then the waitlist form needs to save emails somewhere you can actually query. Copy-paste a zip, set up a database, wire environment variables, curse.
Integrations skip the cursing. You connect an account of yours at another service. Then, in the Publish dialog, one button makes a repository, a project or a database named after the site and uses it on the spot. The thing it made is in your account, under your name, and stays there if you leave.
4
services: GitHub, Vercel, Neon, Supabase
1
click to make and use a new one
2
ways to connect: authorize or a token
0
times you see a credential again
WHICH ONE?
Start from what your design needs
| YOUR DESIGN HAS… | CONNECT |
|---|---|
| A form whose answers should be kept: a waitlist, a contact form, an RSVP | Neon or Supabase → Database |
| Sign-up, sign-in, pages only members see, lists that are each visitor's own | Neon or Supabase: sign-in comes with the database |
| Code you want to keep, review or build on | GitHub → Also send to |
| Hosting of your own, at your own domain | Vercel → Also send to |
| A storefront that sells | Vercel → Store → Deploy store, after the Ecommerce plugin sets its Shopify store |
Neon and Supabase do the same job, so pick the one you already use. With neither, Neon is quicker to start: a new project is ready in seconds, where a Supabase one takes a minute or two.
CONNECT
Paste a token, or authorize
⌘K, type integrations, and the dialog lists all four with what each is for. Click Connect. Where the service's sign-in is set up for PopCraft, a window opens on the service, you approve, it closes. Otherwise paste a token you made there; the dialog links to the right page. PopCraft checks it with the service before keeping it.
The account shows under its service by its name there: a login, a team, an email. You can connect two accounts at one service, say a personal GitHub and the agency's.
A website open in the editor, signed in. Command-K is pressed and integrations is typed; the Integrations dialog opens with GitHub, Vercel, Neon and Supabase. Connect is clicked on Supabase, a token is pasted (shown as dots) and checked: the Supabase account is listed. Vercel is connected the same way.
TOKENS
What each token needs
VERCEL
DEPLOY!Account Settings → Tokens, scoped to the team that should own the project. Wrong team, and you get a 403.
NEON
SQL!Account settings → API keys. A personal or an organization key.
SUPABASE
AUTH!Account → Access Tokens. A personal access token whose account belongs to an organization.
CODE + HOSTING
One site, a repo and a project
Publish first: destinations are sent a published version, never your work in progress. Then, under Also send to, New GitHub repository makes a private repo named after the site and pushes to it. Add destination, New Vercel project, and the same version deploys. Each row links to the commit or the deployment.
A name that's taken gets -2, -3. Already have the repo? Type a few letters in the field below the buttons: it searches every repository and project of every connected account in one list.
A website published as Version 1, with GitHub and Vercel accounts connected. In the Publish dialog, under Also send to, New GitHub repository is clicked: a repository named after the site is made and Version 1 is pushed to it. New Vercel project is clicked next: a project is made and Version 1 deployed. Both rows link to what was sent.
X-RAY
What leaves PopCraft, service by service
No mystery. Each integration sends exactly this, makes exactly this, and leaves the rest of your account alone.
GitHub
Code
SENDS
The static site PopCraft hosts: a page of HTML per screen, site.json, the pc/ scripts, assets/. As one commit on the default branch.
MAKES
A private repository named after the site, if you ask for a new one. .popcraft/files.json, to remember what it wrote.
LEAVES ALONE
Your README, workflows, CNAME: anything PopCraft didn't write. Never the database's secrets.
Vercel
Hosting
SENDS
The same static site, as a production deployment. With a database: DATABASE_URL and the sign-in keys, as encrypted env vars.
MAKES
A project named after the site, with no framework, if you ask for a new one.
LEAVES ALONE
The project's settings and its earlier deployments.
Neon
Database · Sign-in
SENDS
One row per form sent, from the site host. With sign-in: your site's address, to Neon Auth.
MAKES
A project named after the site. One table, popcraft_submissions, one index; popcraft_records for visitors' own data.
LEAVES ALONE
Every other table in the database.
Supabase
Database · Sign-in
SENDS
The same rows. With sign-in: your site's address, added to the project's Auth redirect URLs.
MAKES
A project, if you ask for a new one. In it, a role and schema of the site's own (popcraft_site_…), kept out of public so the REST API doesn't serve them.
LEAVES ALONE
Everything else in the project.
GITHUB, CLOSER
A commit you can review
A website that is published as Version 1, with a GitHub account connected. In the Publish dialog, under Also send to, New GitHub repository is clicked: a private repository named after the site is made in the account, added to the list, and the site is pushed to it at once. The row shows a link to the commit.
A website that is published as Version 1, with a Vercel account connected. In the Publish dialog, under Also send to, the search field lists every project the connected accounts hold; typing brightside-site narrows it to one, and clicking it adds the project and deploys the site at once. The row shows a link to the deployment, marked Building.
Each push is one commit on top of what is there, its message naming the version. Files from an earlier push are replaced, and removed when the site no longer has them; everything else stays. An empty repo gets a README first. Turn on GitHub Pages, hook it to a host, or build on it. On Vercel, each send is a production deployment, rolled back the usual way, and counts toward your plan like any other.
DATABASE
A form that actually saves
Under Database, New Neon database makes a project named after the site and attaches it. From then on every form on the site saves what it is sent. Nothing needs republishing. Submissionsshows them, newest first.
PopCraft makes one table, popcraft_submissions, with the fields as JSON, and touches nothing else. Query it, join it, export it. A visitor's text is stored as data and never run as SQL. The host only takes a form from the site's own pages, for forms the live site has, within size and rate limits.
The coming-soon page, published, with its email sign-up marked as a form and a Neon account connected. In the Publish dialog, under Database, New Neon database is clicked: a project named after the site is made in the Neon account and its database attached, and it is listed. Three visitors then sign up on the site (sent by the recording, as the site sends them). Submissions is clicked and a table shows the three, newest first, with when each was sent and its email.
SIGN-IN
Accounts for your visitors
Turn on Visitors can sign in and the site has accounts: Neon Auth in your Neon database, or Supabase Auth users in your project. A form can create an account, sign in, sign out, change a name or a password, reset a forgotten one, or delete the account. A page can be for signed-in visitors only. A collection can be each visitor's own, or one everyone signed in shares.
Seven templates show it working as whole apps: Daybreak, Wayfarer, Tempo, Saffron, Marginalia, Kindling and Potluck. Each has sign-up, sign-in, a password reset and an account page.
The coming-soon page, published, with its email sign-up marked as a form and a Supabase account connected. In the Publish dialog, under Database, New Supabase database is clicked: a project named after the site is made in the Supabase organization and attached, and it is listed. Three visitors then sign up on the site (sent by the recording, as the site sends them). Submissions is clicked and a table shows the three, newest first, with when each was sent and its email.
Home, signed in, with GitHub and Neon accounts already connected. The account menu opens Integrations, where each connected account is listed under its service with how it was connected. The bin beside the GitHub account is clicked and it is gone; Neon stays.
THE CREDENTIAL
Where your token goes, and where it never does
STEP 1
You
Approve on the service's own page, or paste a token. PopCraft checks it with the service first.
STEP 2
Stored
Encrypted before it is written. Nobody sees it again, including whoever connected it.
STEP 3
Used
Decrypted only on PopCraft's servers, at the moment of a publish or a push.
STEP 4
Sent
Only to the service it belongs to. No API endpoint, plugin or AI tool returns it.
Connections belong to the workspace: your team, or your personal space. In a team, owners and admins connect and disconnect; everyone sees what is connected. Deleting your account deletes your personal workspace's connections.
FROM ZERO
From design to your own stack in five moves
- 1
Open Integrations
Account menu (top right) → Integrations, or ⌘K and type integrations. - 2
Connect an account
Authorize PopCraft on the service's page where that sign-in is set up, or paste a token you made there. It is checked before it is kept. - 3
Publish the site
Destinations and databases hang off a published site. A destination is sent a published version. - 4
Click New … or find one
New GitHub repository, New Vercel project, New Neon database, New Supabase database: made, named after the site, used at once. Or type to find one you already have. - 5
Send later versions
Send version N pushes or deploys again. A database needs nothing: a site already online starts saving at once.
EVERYWHERE
The agent, the CLI and the API
ASK
HMM?“This waitlist form should save the emails.” The agent checks what is connected, recommends Neon, and asks before it makes or attaches anything.
SCRIPT
TAP!popcraft run --ui integration.deploy sends a version; popcraft run --ui integration.submissions --jsonreads what forms were sent.CALL
200!A personal access token lists integrations and adds destinations or databases with
{"create": true}. It can't connect an account.BEING HONEST
What the videos are, and what's not here yet
The clips on this page are the real PopCraft app, talking to stand-ins for GitHub, Vercel, Neon and Supabase that answer with the real integration definitions. No real repository, project or database was touched to film them, and the accounts in them are made up.
Not yet: signing visitors in with Google or GitHub, and shared lists that read from the database. Authorize-in-a-window appears only where that service's sign-in is set up for PopCraft; a token always works. The integrations docs list every error and what to do about it.
ASKED & ANSWERED
Questions, answered
Which services can I connect?
GitHub (code), Vercel (hosting), Neon (database and sign-in) and Supabase (database and sign-in). Each is an account of yours; PopCraft acts in it only when you publish or ask it to.
What does GitHub or Vercel receive?
The same static site PopCraft hosts: a page of HTML per screen, site.json, the pc/ scripts and assets/. GitHub gets it as one commit on the default branch; Vercel as a production deployment. Not a Next.js project, and a static copy doesn't save its forms.
Then how do forms and sign-in work off PopCraft's hosting?
Export the site as a Next.js project: it has its own server and reads DATABASE_URL and the SITE_AUTH_ settings. Deployed to a Vercel project that is a destination, those environment variables are set for you. GitHub is never sent them.
Who in a team can connect accounts?
Connections belong to the workspace. In a team, owners and admins connect and disconnect them; everyone sees which accounts are connected. Nobody sees a credential again after it is saved.
Can the AI agent connect my GitHub?
No. It can see what is connected, recommend an integration, and open the Integrations dialog for you. Anything that makes, attaches or sends something in your account asks you to approve first.
What happens when I disconnect?
PopCraft forgets the credential and withdraws it at the service where the service allows it. A token you pasted stays valid there until you delete it. Repositories, projects and databases stay where they are.
Can I sign visitors in with Google or GitHub?
Not yet. Visitors sign up with an email and password, in Neon Auth or Supabase Auth. Lists everyone shares don't read from the database yet either; a visitor's own lists do.
THE MANUAL, FOR THE DETAILS
PLUG! YOUR TURN.
GitHub, Vercel, Neon and Supabase, wired to your design. Free to start, in your browser or on your Mac.