Connected to what you already run

Money: paying online, and what your bookkeeper gets

Connect the Mollie account your agency already has and every open invoice gains a payment link: iDEAL, Bancontact, cards, SEPA direct debit or PayPal, exactly what your Mollie profile has switched on. The client pays on Mollie's own checkout, so no card data ever passes through here; what comes back is an id, after which schakl. fetches the status from Mollie itself and turns it into an ordinary payment line on the invoice. Walk that route once on Mollie's test key first, because only a real payment proves the callback address is reachable. For accounting you connect your SnelStart administration: clients, issued invoices with the PDF attached and your articles go there, and what comes back is the one thing SnelStart is authoritative about — who has paid. On another package you download every issued invoice and credit note as UBL 2.1, the file Exact Online, Moneybird and e-Boekhouden import.

• Staff press "Betaallink"; a client login in the portal sees "Nu betalen".
• An hourly check picks up whatever a missed callback never delivered.
• The payment layer names no provider, so Stripe or Adyen becomes one extra package (roadmap today).
• Optionally a QR block on the document, switched on under Instellingen → Facturatie.

Domains: the registrar knows who pays, the zone knows where it points

Those are two different questions, and schakl. keeps them apart. Link a Cloudflare account per client and you manage the zone from the domain page itself: nameservers, the live DNS table, export and one domain-wide redirect that schakl. creates and reads back, which is what finally makes a domain marked "redirect" an actual Redirect Rule. The OXXA integration reads your reseller register and puts expiry date, transfer lock, auto-renew, DNSSEC, the delegated nameservers and the holder onto the domain; one action writes back, namely switching the nameservers that completes the move to Cloudflare. And because only a registrar can say which domains you renew, that is also what decides which domains you may invoice.

• An account is a row, not a setting: your agency has one and your clients bring their own.
• What schakl. decided and what it last observed are stored separately.
• So somebody changing something in the provider's dashboard is reported as drift, not silently overwritten.
• The first sync shows which domains you renew that schakl. did not know about.

Google Workspace, and the numbers riding on it

You register your own Google Cloud OAuth client as an Internal app; that is what makes the restricted Gmail and Drive scopes usable without the review Google demands of public apps. After that every colleague links themselves, in one extra click. Approved leave and scheduled tasks go to their own Google Calendar, the Drive panel opens the client's folder, and mail with a known contact lands on the client timeline once the mailbox owner approves it. Your marketing sources ride the same grant: Google Analytics 4, Search Console and Google Ads are linked per client, after which the daily figures are pulled overnight and kept in your own database. SE Ranking runs on a single API key for the whole agency, and Rank Math supplies a fifth source, a client's AI visibility, on the WordPress password belonging to that one website.

Advertising and measuring, with the split in the right place

Google Ads became a module of its own, because an agency does more with an advertising account than look at it. You read campaigns, spend, search terms, devices and geography, and you change budgets, keywords, exclusions and campaigns, each behind its own permission: a key that may tidy search terms overnight need not also be able to touch the budget. A policy per advertiser holds the guardrails (protected brand terms, a ceiling on the daily budget, how far a budget may rise in one change), and what you deliberately *do not* exclude is recorded too, because otherwise the same shortlist comes back every month. Tag Manager sits beside it and covers the other half: which container is this client's, what is live in it, and what has been staged for three weeks without being published. There, editing a workspace and publishing are two separate permissions, because the first changes a draft nobody is served and the second changes what runs in every visitor's browser.

• Four write permissions on Ads: campaign, budget, keyword and exclusion
• Everything is created paused, and every write can be dry-run first
• Tag Manager writes in a workspace of its own, so unfinished work never lands in the client's draft

What runs on a client's site, and whether it is up

Two integrations hang off the website rather than off the domain. One WordPress Application Password per site opens four surfaces on the same host: the ordinary REST API, WordPress 6.9's Abilities API, the MCP server where that plugin is installed, and Rank Math's own AI Visibility route. Uptime Kuma is the open-source monitor most agencies already run; connect it and a monitor becomes a record with a client, a website, a profile and a history, instead of an alert that fires once. If the client's own Kuma sits behind a firewall it still works, because then the traffic runs the other way and we send nothing into it.

• Five independent probes when verifying a WordPress site, none of them deciding the verdict of the others
• Monitor profiles instead of retyping the same settings three hundred times
• What we decided and what we last observed are stored apart, so somebody editing in Kuma itself stands out

Signing in with the account your agency already has

Single sign-on works with any OpenID Connect provider: Google Workspace, Microsoft Entra ID, Authentik, Keycloak or Auth0. You configure it entirely in the app, under Instellingen → Single sign-on, with no environment variables and no restart, and "Verbinding testen" proves it works before anyone relies on it. If you want to go further, you switch password login off for the whole organisation; the API refuses to store that until the current settings have passed a test, and an operator break-glass stays available. Two-factor verification needs no integration at all: an authenticator app and ten one-time backup codes are simply there. Only the SMS fallback wants a gateway, and with none configured the SMS option does not exist anywhere in the product.

Yours to point at: storage, delivery and model

Files sit on a volume beside the database by default; set the storage backend to s3 and the app writes to any S3-compatible bucket, from Hetzner Object Storage to MinIO, Scaleway or AWS. Identical bytes cost one object per organisation, so the same signature logo arriving on five hundred messages is one object and not five hundred. For delivery you pick whoever you already pay: your own SMTP server, or Brevo, SendGrid or SMTP2GO over their HTTP API. Everything the app sends leaves wrapped in your logo, brand name and colour with your signature underneath, and the name schakl. appears nowhere in it. For AI you bring your own provider: Anthropic, OpenAI, or anything speaking their chat API on a base URL of your own, right down to an Ollama or vLLM in your own rack. Speech-to-text is a separate key, because Anthropic has no transcription service.

Anything the app can do, a script can too

The web app never talks to the database directly: everything goes over /api/v1, so there is no back door a script misses. The interactive reference lives on your own host at /api/docs, with the OpenAPI document at /api/openapi.json, and you authenticate with an API key carrying exactly the permissions you tick — personal, or a service account that keeps working when someone leaves. The same spec feeds the MCP server at /mcp, where every operation is a tool for Claude or any other AI client; that tool call travels in-process through the same gate as the web app, so hostname to organisation, RLS bound, permissions resolved. The complete endpoint list is published in the documentation, each with the permission your key has to carry. Subscribing to events is still on the roadmap; an automation rule can call a webhook today, and a notification channel can post to a webhook URL. The core of schakl. is open source (AGPL): integration modules like Mollie, Cloudflare, OXXA, Google and marketing are extensions needing a licence key, and so is the MCP server, while single sign-on, S3 storage, mail delivery and the REST API belong to the core.