OAuth connections, and your data warehouse

Two kinds of system were out of reach until now: the ones that only hand out access through OAuth, and the warehouses where your numbers live. Both are in today, taking Murmurator to more than seventy connections.

Connect with OAuth

Add the connection, press Connect, approve access at the provider, and you're back on the connection page with a working test call. Access tokens are kept encrypted and renewed before they expire. If a provider stops accepting the connection, it's marked failing and Reconnect starts over.

• Google Sheets, Google Calendar, Google Drive and Gmail
• Microsoft Outlook and Microsoft Teams
• Salesforce, QuickBooks Online and Xero, with triggers from QuickBooks and Xero webhooks

Zoom, Help Scout and Shopify's Dev Dashboard apps use an app's client ID and secret with no browser step. Murmurator fetches their short-lived tokens and renews them on its own, which also means new Shopify stores can connect again.

Bring your own OAuth app by pasting its client ID and secret, or have your administrator configure one app for every account. See connecting with OAuth.

Query your warehouse

Snowflake, BigQuery, Databricks, Amazon Redshift, ClickHouse and CockroachDB join PostgreSQL and MySQL, with the same query, list_tables and describe_table tools, and execute once writes are allowed. Queries are read-only by default, capped at 1,000 rows and 15 seconds, and parameters are always bound, never pasted into the SQL.

How read-only is enforced depends on what each warehouse offers: read-only transactions on Redshift and CockroachDB, ClickHouse's readonly setting, a dry run that must come back as a SELECT on BigQuery, and a single read statement on Snowflake and Databricks, where a read-only role is the real safeguard.

See it in the daily revenue watch example, which compares yesterday's revenue in Snowflake against the usual and only speaks up when something moved.