Chapter 6: Channels & Connectivity 🟡 BETA

This chapter catalogs all external services that General Bots integrates with.

Overview

General Bots connects to external services for extended functionality. All service credentials should be stored in config.csv within the bot’s .gbot folder - never hardcoded in scripts.

Infrastructure services (database, storage, cache) are automatically managed by the Directory service (Zitadel).

Service Categories

CategoryServicesConfiguration Location
LLM ProvidersOpenAI, Groq, Anthropic, Azure OpenAIconfig.csv
WeatherOpenWeatherMapconfig.csv
Messaging ChannelsWhatsApp, Teams, Instagram, Telegramconfig.csv
StorageS3-Compatible (MinIO, etc.)Vault (automatic)
DirectoryZitadelVAULT_* environment variables
EmailStalwart / IMAP/SMTPVault (automatic)
CalendarCalDAV serversconfig.csv
DatabasePostgreSQLVault (automatic)
CacheRedis-compatibleVault (automatic)

Quick Reference

BASIC Keywords That Call External Services

KeywordServiceConfig Key
LLMLLM Providerllm-provider, llm-key
WEATHEROpenWeatherMapweather-api-key
SEND MAILSMTP ServerManaged by Directory service
SEND WHATSAPPWhatsApp Business APIwhatsapp-api-key, whatsapp-phone-number-id
SEND TEAMSMicrosoft Teamsteams-app-id, teams-app-password
SEND INSTAGRAMInstagram Graph APIinstagram-access-token, instagram-page-id
GET (with http/https URL)Any HTTP endpointN/A
IMAGEBotModels (local)botmodels-enabled, botmodels-url
VIDEOBotModels (local)botmodels-enabled, botmodels-url
AUDIOBotModels (local)botmodels-enabled, botmodels-url
SEEBotModels (local)botmodels-enabled, botmodels-url
FINDQdrant (local)Internal service
USE WEBSITEWeb crawlingN/A

Service Configuration Template

Add these to your config.csv:

key,value
llm-provider,openai
llm-api-key,YOUR_API_KEY
llm-model,claude-sonnet-4.5
weather-api-key,YOUR_OPENWEATHERMAP_KEY
whatsapp-api-key,YOUR_WHATSAPP_KEY
whatsapp-phone-number-id,YOUR_PHONE_ID
whatsapp-verify-token,YOUR_WEBHOOK_VERIFY_TOKEN
teams-app-id,YOUR_TEAMS_APP_ID
teams-app-password,YOUR_TEAMS_PASSWORD
instagram-access-token,YOUR_INSTAGRAM_TOKEN
instagram-page-id,YOUR_PAGE_ID
botmodels-enabled,true
botmodels-url,http://localhost:5000

# Human Handoff / CRM Features
crm-enabled,true
attendant-llm-tips,true
attendant-polish-message,true
attendant-smart-replies,true
attendant-auto-summary,true
attendant-sentiment-analysis,true

Auto-Managed Services

The following services are automatically configured by the Directory service (Zitadel):

ServiceWhat’s Managed
PostgreSQLConnection credentials, database creation
S3-Compatible StorageAccess keys, bucket policies
CacheConnection credentials
Stalwart EmailUser accounts, SMTP/IMAP access

You do not need to configure these services manually. The Directory service handles credential provisioning and rotation.

Security Notes

  1. Never hardcode credentials - Always use config.csv or GET BOT MEMORY
  2. Rotate keys regularly - Update config.csv and restart the bot
  3. Use least privilege - Only grant permissions needed by the bot
  4. Audit access - Monitor external API usage through logs
  5. Infrastructure credentials - Managed automatically by Directory service

Inbound Channel Webhooks

Chat platforms deliver messages by posting to the bot server from their own infrastructure, with no token of ours to present. Three registrations are required for every such route, and missing any one of them makes the channel silently unreachable:

  1. an anonymous auth path (the middleware otherwise answers 401),
  2. a CSRF exemption (external POSTs cannot carry a CSRF token),
  3. an anonymous RBAC route permission (an unmatched /api/... path is denied outright).

The routes, their handlers and the documented credential resolution are:

ChannelInbound routeHandler auth
TelegramPOST /webhook/telegramoptional telegram-webhook-secret (X-Telegram-Bot-Api-Secret-Token)
TeamsPOST /api/msteams/messagesBot Framework activity validation
InstagramGET/POST /api/instagram/webhookverification token (hub.verify_token) + payload signature
WhatsAppGET/POST /webhook/whatsappMeta verify token (hub.verify_token)

Channels addressed directly (outside /api) also need a proxy route in the UI server, which is what /webhook/*path provides.

See Also