Provider connections

A provider connection lets Squasher create the delivery setup in your cloud account, so that you do not configure each drain by hand. Start a connection from Integrations in the dashboard, or through the Squasher API.

Supported providers

Provider	How you approve access	What Squasher sets up
AWS	Launch a CloudFormation stack	An Amazon Data Firehose stream and CloudWatch Logs subscription filters
Cloudflare	OAuth	Workers Observability destinations for logs and traces, on 1 to 100 selected Workers; optional zone and Worker analytics
Google Cloud	OAuth	A Cloud Logging sink, a Pub/Sub topic and push subscription, and a metrics pull
PlanetScale	A service token	A metrics pull every 5 minutes and a webhook for deploy requests
Render	A Render API key	A log pull every 5 minutes and a workspace metrics stream
Notion	OAuth	See the Notion guide
Sentry	Sentry app installation	See the Sentry guide

Vercel and Railway connect the same way: install or approve Squasher in the provider, then choose the provider project in Integrations. The Cloudflare connection can also pull zone and Worker analytics. See Cloudflare analytics metrics. PlanetScale has no connect plan: you send the service token in one request. See PlanetScale.

Connect from the dashboard

Open your project and select Settings in the sidebar, then the Integrations tab.
On the provider card, select Connect. For Render, enter a Render API key. For AWS, choose the Region and the log groups, then select Open CloudFormation.
Approve the access in the provider. Squasher returns you to Integrations with a message.
If the card asks for a choice, for example the Cloudflare Workers or the Google Cloud project, make it on the card.

A card that shows Manual setup cannot connect from the dashboard yet. Its button opens the steps that set up the same delivery by hand. A card that shows Unavailable has no other path. Repair checks the connection and recreates missing resources that Squasher owns. Disconnect removes them.

Connect through the API

Prerequisites

An API key with the project:write permission for the project. The ingest key from the Setup page does not have it. See API keys.
Access to the provider account, with permission to approve the connection.

Start a connection

Request a connect plan

Replace cloudflare with aws, gcp, render, notion, or sentry.

curl -X POST "https://api.squasher.ai/v1/projects/$SQUASHER_PROJECT_ID/provider-connections/cloudflare/connect-plan" \
  -H "x-squasher-key: $SQUASHER_ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

For AWS, send the Region and the log groups in settings:

{ "settings": { "region": "us-east-1", "log_group_names": "/aws/lambda/checkout,/ecs/api" } }

To use the account-level subscription policy instead of named log groups, send "account_wide": true.

Approve access in the provider

The response has an action. When it has a url, a person opens it and approves access. An API client cannot approve it. The AWS launch link expires at expires_at and works once. For Render, the action is api_key_form: go to the next step.

Choose what to connect

Provider	Requests
AWS	None. The stack registers itself with Squasher when AWS creates it.
Cloudflare	`GET .../cloudflare/accounts`, `GET .../cloudflare/workers?account_id=<id>`, then `POST .../cloudflare/provision` with `account_id` and `worker_ids`
Google Cloud	`GET .../gcp/projects`, then `POST .../gcp/select` with `gcp_project_id` and `log_filter`
Render	`POST .../render/workspaces` with `api_key`, then `POST .../render` with `api_key` and `workspace_id`

Each path starts with /v1/projects/<project-id>/provider-connections.

Check the connection

curl "https://api.squasher.ai/v1/projects/$SQUASHER_PROJECT_ID/provider-connections" \
  -H "x-squasher-key: $SQUASHER_ADMIN_KEY"

Each connection has a status and a last_error. For the freshness and the last error of each data stream, request GET /v1/projects/<project-id>/provider-health, or run squasher integrations health.

Repair or remove a connection

POST .../provider-connections/<provider>/reconcile reads the provider again and updates the status.
DELETE .../provider-connections/<provider> removes the resources that Squasher created and the ingest key that it made for them.
For AWS, delete the squasher-logs CloudFormation stack in AWS instead. The API cannot remove it.

Squasher does not replace a provider resource that another tool owns. For example, if Render already streams workspace metrics to another destination, Squasher keeps it and pulls metrics instead.

Get started

Guides