> ## Documentation Index
> Fetch the complete documentation index at: https://docs.expira.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations overview

> How Expira connects to AWS, GitHub, GitLab and App Store Connect, syncs expiry dates every day, and what it stores.

An integration connects Expira to a provider. Expira reads the expiry dates of what it finds there, adds them as [synced assets](https://docs.expira.dev/concepts.md#synced-and-manual-assets), and checks again every day.

> [card] [AWS](https://docs.expira.dev/integrations/aws.md)
>
> ACM, IAM, RDS, Secrets Manager, KMS, Route 53 and more.

> [card] [GitHub token](https://docs.expira.dev/integrations/github-token.md)
>
> The expiry of the token you connect.

> [card] [GitHub App](https://docs.expira.dev/integrations/github-app.md)
>
> Every fine-grained token in your organisations.

> [card] [GitLab](https://docs.expira.dev/integrations/gitlab.md)
>
> Access, deploy, runner, trigger and agent tokens.

> [card] [App Store Connect](https://docs.expira.dev/integrations/app-store-connect.md)
>
> Certificates, profiles and Apple Pay merchant certificates.

Only organisation **owners and admins** can add, edit, sync or remove integrations. Integrations live under **Integrations** in the dashboard.

## When integrations sync

Every integration syncs once a day (times in UTC):

| Time | Provider |
| - | - |
| 07:30 | AWS |
| 07:45 | App Store Connect |
| 08:00 | *Alerts are sent* |
| 08:30 | GitHub token |
| 08:45 | GitHub App |
| 09:00 | GitLab |

AWS and App Store Connect sync before alerts go out, so something found that morning can alert the same day. GitHub and GitLab findings alert on the next day's run. Press **Sync** on an integration to sync it now.

## What a sync changes

* **New credentials** are added as assets.
* **Changed credentials** are updated: expiry, name and link.
* **Deleted credentials** are removed from Expira, with their alert history. Expira only removes an asset after a **complete** listing of that category. If the provider returns an error, refuses access or stops part-way, nothing in that category is removed.
* **Tokens that expired more than 30 days ago** are removed, because providers keep listing expired tokens that were never revoked.

After a sync the card shows a summary such as "Sync complete — 3 new, 1 updated, 0 removed assets." or the errors it hit. See [Troubleshooting](https://docs.expira.dev/integrations/troubleshooting.md).

## What counts as an integration connection

Each connected account or token is one connection: for example one AWS account, one GitHub App, or one GitLab instance. Plans allow:

| Plan | Integration connections |
| - | - |
| Starter (free) | 1 |
| Pro | 10 |
| Scale | Unlimited |

## What Expira stores

* The **credential** you connect is stored encrypted in Supabase Vault and is never sent back to your browser. When you edit an integration the field stays empty: leave it blank to keep the stored credential.
* Expira uses it only to read expiry information from that provider, once a day and when you press **Sync**.
* From the provider, Expira keeps only metadata such as names, expiry dates and links. It never stores the secret values of the credentials it discovers.
* Use a **dedicated, read-only credential with its own expiry date.** Expira can then remind you to renew it too.

## Pause or remove an integration

* **Pause** stops daily syncs and keeps its assets. **Resume** starts them again.
* **Remove** deletes the stored credential and stops syncing. You choose what happens to the assets it found:
  * **Delete** them permanently, including their alert history.
  * **Keep** them as editable manual assets.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.