Platform · Integrations
Every integration, labelled by what it does today
Spy Monk talks to the outside world in four ways: it reads public sources, it will connect to accounts you own, it reaches you through the channels you choose, and it takes payment through Indian gateways. Each is listed here with its honest status — live, coming in Phase 2, or pending feasibility.
Updated By Drive Digital Editorial
See the coverage table for yourself
Official APIs and permission screens only · No scraping of private content · Coverage reported per source
Direct answer
Which integrations does Spy Monk support?
Today Spy Monk reads public sources — news feeds, and web search and YouTube results when those providers are configured — and reports coverage per source. Account connectors such as Google Business Profile and YouTube channel access are Phase 2. Messages go only by e-mail and WhatsApp (with recorded opt-in); payments run through Razorpay or Paytm.
- Live sources: news; web search (SerpAPI or Google Custom Search) and YouTube when configured
- Account connectors (Google Business Profile, Search Console, GA4, Facebook, Instagram, YouTube, LinkedIn, X, Play, App Store, CRM, email): Phase 2, pending per-provider approval
- Channels: transactional e-mail and the WhatsApp Business API only — no SMS, no push; an in-app alerts list keeps the record
- Payments: Razorpay and Paytm, verified by signature before anything activates
Principle
Approved access or nothing
Our first release gate reads: approved connector access. No source is reported as live without an approved key or connector; every unavailable source is labelled in the interface, in the PDF and in the API; and no account connector is enabled until its provider has reviewed the application and the scopes it asks for. This rules out the shortcuts some tools take — scraping content behind logins, buying data of uncertain provenance, or implying access they do not have.
It also explains the shape of this page. The list of connectors in our specification is long: Google Business Profile, Search Console, Analytics, Facebook Pages, Instagram professional accounts, YouTube, LinkedIn organisations, X, Google Play, App Store Connect, CRM and support systems, email and business messaging. Every one of them requires the platform's official permission screen, a review of the scopes requested and, for several, a formal approval of the application. The database tables, encrypted token storage and interface cards for these connectors exist; the OAuth flows ship provider by provider in Phase 2, and the connector health view reports them as pending feasibility until then. That label is deliberate: not "coming soon", which promises a date, but "we are verifying what is possible".
If a provider refuses or restricts access, Spy Monk will say so and work without that source rather than approximate it.
Reading public sources
Source adapters
Each adapter runs independently and writes its own coverage row. A source without a configured provider is listed as unavailable, never silently skipped.
- News — publisher and aggregator feedsAvailable now
- Web search results — via SerpAPI or Google Custom SearchAvailable nowRuns when a search provider key is configured by the platform operator; otherwise listed as unavailable in every coverage table. Google Custom Search is closing to new customers at the end of 2026.
- YouTube video and channel results — YouTube Data APIAvailable nowRuns when a YouTube API key is configured.
- URLs you submit yourselfAvailable nowFetched safely, stored as a mention with an evidence snapshot.
- Google reviews, social posts and comments, app-store reviewsPhase 2Require account connectors through each platform's permission screen.
- Blogs and forums as a distinct sourcePhase 2Appear today through web search results where available.
- Licensed media-monitoring feeds (print, broadcast)Pending feasibilityDepends on licensing; the adapter slot exists.
- Available now
- Available now4 items
- Phase 2
- Phase 22 items
- Pending feasibility
- Pending feasibility1 item
Connecting accounts you own
Account connectors
All connectors will use the provider's official consent screen and show exactly what Spy Monk can read. None is enabled in the current release.
- Google Business Profile — your reviews and repliesPhase 2First in the Phase 2 sequence, with YouTube.
- YouTube channel — comments on your videosPhase 2
- Google Search Console and Google Analytics 4Phase 2
- Facebook Pages, Instagram professional accountsPending feasibilitySubject to Meta app review and permitted scopes.
- LinkedIn organisation pages, XPending feasibilitySubject to each platform's API access terms.
- Google Play and App Store Connect reviewsPending feasibility
- CRM and customer-support systems, business emailPending feasibilityNeeded for review verification (Phase 3); an unmatched reviewer is never treated as proof of anything.
- Ownership and authorisation verification of connected propertiesPhase 2
- Phase 2
- Phase 24 items
- Pending feasibility
- Pending feasibility4 items
Reaching you
Message channels: e-mail and WhatsApp only
Spy Monk sends sign-in codes, invoices, reports, alerts, support replies and case updates by e-mail or WhatsApp — nothing else. There are no SMS messages and no push notifications. Every notification is also kept in your in-app alerts list; payment, account and credit notices cannot be muted.
- Available now
E-mail
Sign-in codes, audit-ready notices, high-risk alerts, case updates, approvals, invoices and reports, each with a text and an HTML version. Quiet hours hold non-urgent messages until the window ends; sign-in codes are never delayed.
- Available now
WhatsApp Business API (Meta)
Approved utility templates — case updates, alerts, invoices, reports, appointment reminders, help replies — only to numbers you have verified and opted in, with STOP honoured immediately. Templates go live after Meta approves them for Drive Digital's account.
- Available now
Sign-in codes on WhatsApp
You choose e-mail or WhatsApp for your one-time code. WhatsApp uses Meta's authentication template with a copy-code button. If one channel is unavailable, you are offered your other verified channel — never a hidden fallback.
- Available now
Delivery states you can trust
Each message shows queued, sent, delivered or failed as the provider reports it. "Read" appears only when the provider reliably says so; otherwise it stays delivered or not confirmed.
- Available now
In-app alerts list
A passive record of every notification in the web console and the companion app. Nothing is pushed to your phone's lock screen.
Payments and the public site
Commerce and measurement
- Available now
Razorpay
Subscriptions and scan-credit purchases. Checkout and webhook signatures are verified; capture is exactly-once; invoices are numbered from a gap-free series.
- Available now
Paytm
An alternative gateway. The platform operator chooses Razorpay, Paytm or customer choice at checkout; a production server with neither configured refuses orders instead of using a demo.
- Available now
Google Analytics 4 (consent-first)
On the public website only, and only after you press Allow. Consent Mode v2 defaults are denied, advertising signals stay off, and the dashboard sends nothing unless a workspace opts in.
- Available now
Search Console and Bing verification
Site-ownership tags for the public website — used to submit the sitemap and read search performance, nothing more.
Keys and credentials
How provider keys are kept
Provider credentials — search keys, mail server passwords, gateway secrets, WhatsApp tokens — are configured by the platform operator in an administration console that requires two-factor authentication, not by customers and not in code. Every saved secret is encrypted at rest with AES-256-GCM under a per-installation key, is write-only after saving (the console shows only that it is set and its last four characters, to super administrators), and every change requires a stated reason that is written to the audit log.
A Test connection button checks each provider without sending anything to a customer: it signs in to the mail server, reads the WhatsApp number's verified name, or calls the gateway's order list with the saved keys. On development servers a yellow Test mode banner marks results that came from a mock provider; a production server ignores that setting and always talks to the real provider.
When a connector for an account you own ships, its tokens will be stored the same way, used only for the scopes you approved on the provider's screen, and revocable from your settings and from the provider's side.
Questions
Integration questions
Can Spy Monk read my Google reviews today?
Not directly. Reviews on your Google Business Profile need the account connector that is first in the Phase 2 sequence. Reviews that appear in public web search results can surface as mentions where the search provider is configured.
Why does my coverage table say web search is unavailable?
The platform operator has not configured a search provider key, or the provider returned an error during the run. Spy Monk lists the source as unavailable and excludes it from the score rather than estimating. Web search uses SerpAPI or Google Custom Search.
Will I receive WhatsApp messages from Spy Monk?
Only on a number you have verified and opted in, and only approved utility templates and sign-in codes — case updates, alerts, invoices, reports, appointment reminders and help replies, as you choose. Reply STOP (or रोकें) to opt out immediately. Spy Monk sends no marketing on WhatsApp.
Does Spy Monk send SMS or push notifications?
No. E-mail and WhatsApp are the only channels Spy Monk uses to reach you, for sign-in codes as well as alerts, invoices and reports. The web console and the app keep an alerts list you can open at any time, but nothing is sent by SMS and nothing is pushed to your device.
Can I connect my CRM to verify reviewers?
Not in the current version. CRM and review connectors are pending feasibility, and review verification is a Phase 3 workflow. When it exists, a reviewer missing from your records will be marked unverified — never fraudulent.
Is there an API I can integrate with?
Yes. The REST API is documented with OpenAPI 3.0 and is an entitlement of the Business plan. See the API page for authentication, idempotency and limits.
Do you scrape websites?
Spy Monk fetches public pages that you submit and queries providers through their APIs. It does not log into platforms on your behalf, bypass access controls or collect content behind logins.
See which sources cover you
Every free audit ends with a coverage table — the honest version of an integrations list.
No card needed