Under the hood

Connectors

Stale learns by reading where work already happens. Every connector reduces its raw events to the same thing, then trust is decided at the door.

Push and pull

Push connectors wait: Slack events, forwarded email and webhooks arrive when something happens. Pull connectors fetch: you choose repos, projects or pages and press Sync, and anything already seen is skipped.

At a glance

Connector	Mode	Reads	Trusted	Untrusted	You need
Slack	Push	Messages in channels the bot is invited to, live	Your workspace members	Slack Connect, outside guests, other apps’ bots	Signing secret + bot token
Email	Push	Subject and plain-text body of forwarded mail	Senders at the domains you list	Everyone else, including look-alike domains	A mail rule or inbound parse service
Webhook	Push	Any JSON you POST	Whatever you decide per call	Set untrusted: true	The integration secret
GitHub	Pull	Issues, pull requests and their comments	Owners, members, collaborators	Drive-by commenters on public repos	Fine-grained token, read access
Jira	Pull	Issues and comments in chosen projects	Your team	Service-desk customers	Atlassian Cloud site, email, API token
Notion	Pull	Text of pages shared with the integration	Pages in your workspace	–	Internal integration secret

Each connector has a step-by-step guide on its page under Integrations inside the app.

Send anything: the generic webhook

If a tool can send a POST, it can teach Stale. Create a Webhook integration to get an address and a secret, then:

curl -X POST https://YOUR-HOST/api/hooks/generic/int_xxxx \ -H "x-stale-secret: YOUR_SECRET" \ -H "content-type: application/json" \ -d '{"source":"CRM","author":"Dana","text":"The renewal price is $9,000 per year."}'

Or call ingest directly

With an API key you can skip integrations entirely:

curl -X POST https://YOUR-HOST/api/v1/ingest \ -H "Authorization: Bearer sk_YOUR_KEY" \ -H "content-type: application/json" \ -d '{"kind":"manual","source":"Pricing sheet","text":"Support SLA is 4 hours for premium customers."}'

Field	Meaning
`text`	Required. Up to 20,000 characters.
`source`	Required. Where it was said. Messages with the same value share one Source.
`kind`	slack · webhook · email · upload · manual · github · jira · notion · drive. Default `manual`.
`author`	Who said it. Kept with the quote.
`untrusted`	Set `true` if it came from outside the company.
`externalId`	Your own dedupe key. Sending the same one twice is a no-op.
`url`, `ts`	Link back to the original, and when it was said (ms since epoch).

The response says what happened to each claim: added, confirmed, updated (with how many things went stale) or queued for review.

What happens to your tokens

Connection secrets are encrypted at rest with AES-256-GCM using your workspace’s STALE_SECRET. Webhook secrets are compared in constant time. Slack requests must carry a valid signature or they’re rejected.