# Integrations

> Connect GitHub, cloud providers (Hetzner, DigitalOcean, Vultr, Linode, AWS) and DNS providers (Cloudflare, Route 53, DigitalOcean, Hetzner).

Integrations live under **Settings → Integrations**. Every token and key is encrypted with your organization's key and never shown again.

## GitHub

**Settings → GitHub → Connect GitHub** installs the Zefily GitHub App on your account or organization. GitHub asks which repositories the app may read; Zefily gets read-only access to their contents, with tokens that last one hour. Connect more accounts with **Connect another account**; **Disconnect** removes one.

How it is used:

1. Connect an account and choose the repositories (you can change the list on GitHub any time).
2. Open a server → **Sites** → your site → **Deploy** and pick the account and repository from the list — no deploy key needed.
3. Turn on **push to deploy**: every push to the site's branch deploys it, and GitHub shows the deploy status on the commit.

See [Git deploys](/docs/deploy-from-github).

## Cloud providers

**Settings → Cloud providers** connects provider accounts so Zefily can create, power-cycle, snapshot and delete servers there. Enter a **Name** and an API token with read and write access:

| Provider | Where to create the token |
| --- | --- |
| Hetzner Cloud | Cloud Console → your project → Security → API tokens → Generate (Read & Write) |
| DigitalOcean | API → Tokens → Generate New Token with Read and Write (or custom scopes for droplets) |
| Vultr | Account → API → Enable API. Vultr keys have full access: restrict them to our gateway IP there |
| Akamai Linode | Profile → API Tokens → Personal Access Token with Linodes: Read/Write |
| AWS EC2 | An IAM user with the Zefily EC2 policy, then an access key; enter `ACCESS_KEY_ID:SECRET_ACCESS_KEY` |

The token is verified when you connect it. Then **Servers → Add server** offers the account's regions, sizes and systems — see [Connect a server](/docs/connect-a-server). The provider bills the servers as usual.

## DNS providers

**Settings → DNS providers** gives Zefily API access to your DNS for certificates through **DNS-01**: wildcard aliases, and sites not reachable on port 80 (behind a proxy).

| Provider | Credentials |
| --- | --- |
| Cloudflare | My Profile → API Tokens → Create Token → "Edit zone DNS" template, limited to the zones you need |
| Amazon Route 53 | An IAM user with `route53:ChangeResourceRecordSets` and `route53:GetChange` on the hosted zone, plus `route53:ListHostedZonesByName`; access key, secret, optional region and hosted zone id |
| DigitalOcean | API → Generate New Token with the domain scopes (read, create, delete) |
| Hetzner DNS | DNS Console → API tokens → Create access token |

Select the DNS provider in a site's **Domain validation** — see [HTTPS and certificates](/docs/https-certificates). The server keeps the key, sealed for it, to renew on its own.

## Notifications

Slack, Discord, Telegram and signed webhooks are set up under **Settings → Notifications** — see [Notifications and webhooks](/docs/notifications).

---
Source: https://zefily.com/docs/integrations