Connect your other tools

Analytics, search, ads, your CMS, social accounts, your CRM, your email tool, reviews and more.

View as Markdown

HeyCMO is an invitation-only, $0 operational Alpha for Stripe and Resend recovery emails. A person approves every message before it is sent. The guides also describe implementation capabilities outside the Alpha. Their presence here does not make them available in the pilot. Start with the Alpha checklist. Help: alpha@heycmo.ai.

Integration secrets

Most of your other accounts connect on Settings → Connections, with a sign-in or one key: Google (Analytics, Search Console, Google Ads), LinkedIn, Meta, Microsoft Advertising, X, your CRM, Canva, your email tool, product analytics, GitHub releases, review sites, your affiliate program and conversions (the sections below). Settings → Advanced → Integration secrets is only for credentials you paste by hand, for a provider with no connect flow:

Secrets are encrypted at rest (envelope encryption) and never displayed again.

Connect your CMS (WordPress, Ghost, Webflow, Sanity, Contentful, or Git PRs)

HeyCMO can save approved posts to your blog or marketing site as drafts, publish them, and reverse eligible changes (posts the write created or drafts it published). On WordPress it can also edit a page you already have (its title, SEO title and description, text, or a sentence that gains a link), and undo that edit. Paste one connection's JSON in Settings → Advanced → Integration secrets: Sanity, Contentful and a GitHub repository have Check and save, which checks the connection with the provider before storing it; for WordPress, Ghost and Webflow, saving checks only the JSON's shape (and that the site is a public https address):

Then turn publishing on: Settings → Channels → Write channels → CMS publishing shows the connection ticked; accept the write terms and Request. Until the HeyCMO operator approves it, approving a post only rehearses it (nothing reaches your CMS) — the same safety you get with live email. Every post is its own card in the inbox, showing the post exactly as it will read. HeyCMO updates a post that already has the same address (slug) instead of creating a second one, and never turns a published post back into a draft. A blog-post, page-copy or press-release draft (playbooks T-01, T-02, T-08) in your inbox has a Send to CMS as draft button, and the playbooks whose result is a post or a page (a launch or feature announcement, a press release, a landing page, comparison pages, a program page, a webinar's registration page and others) save their approved post or page as a CMS draft card themselves. A comparison-page card (PB-24) lists each sentence about a competitor and whether it cites a source, so you check the claims before you publish. An SEO content brief has Draft this instead (next section). You can revoke the channel or reverse an eligible applied write (POST /v1/external-writes/:actionId/reverse, for posts the write created, drafts it published, and page edits) any time.

From a search to a published post (SEO content)

With Search Console connected (and a CMS for posts; reading your post list and editing a page need WordPress), the SEO and content loops work from your own numbers; nothing reaches your site until you approve a card.

• Your pages. Once a week HeyCMO reads each page's Search Console clicks (the last 90 days against the 90 before), its GA4 page views when GA4 is connected, and your WordPress posts and pages. The Content page (under Grow) shows what it read and your busiest pages; Refresh now reads them again. Content decay, content repurposing and landing-page checks work from this list (a partner push through PUT /v1/ingest/content replaces it).
• Technical audit. The first time HeyCMO crawls your site, and then once a month, an inbox card lists what the crawl found (broken links, missing titles and descriptions, canonical and sitemap problems) and your Core Web Vitals. Loops → Run technical audit runs one now.
• Briefs. A keyword-gap brief says, for each search, what the searcher wants, how close they are to buying, which of your customer groups it serves, the page it should lead to, competitor pages that rank and related searches. A search one of your pages already ranks for is a brief to improve that page; a search with no page is a brief for a new one. AI answer gaps (the GEO page) become briefs too.
• Draft this. The button on a brief writes the article (1,200–2,000 words, from your product details, brand tone and what HeyCMO knows) and checks it: the title's length, the search in the title and first paragraph, links to your site, no made-up links, and a title no other page of yours has. A brief with several searches has one Draft this per search. A new page becomes a draft post card; a page that already ranks becomes an edit card showing each change before and after (WordPress only). Writing needs a model on your HeyCMO deployment; without one the button says so and nothing is saved. The draft replaces the whole page, so a page with images, videos, tables, forms or other parts it cannot keep, or one longer than it reads, is not rewritten: the button says what, and nothing is saved. Draft refresh on a content refresh brief rewrites a page that lost its clicks the same way, and Propose link edits on an internal-linking report adds links inside sentences of your pages, one card per page.
• Publish. Approving a draft card saves the post in your CMS as a draft (once CMS publishing is on, above). The Content page then offers Publish: its own card; approving it publishes the post, and, when you stored an IndexNow key, HeyCMO proposes sending its address to IndexNow (Bing and others, not Google) as one more card. A draft card approved while CMS publishing was off was only rehearsed: turn publishing on and press Draft this again for a fresh card of the same article (if the page was edited in WordPress since, HeyCMO drafts it again from the page as it is now, so your newer change is kept). A publish card you declined, or one that failed or was only rehearsed, is replaced by a fresh one when you press Publish again. A page HeyCMO sees for the first time (in Search Console, your post list or a crawl) is proposed for IndexNow the same way.
• What it did. 14, 28 and 56 days after a post goes live (or a page edit), HeyCMO reads that page in Search Console: its clicks, impressions and average position, and for an edit the same days before it. They show under Changes HeyCMO made in the Inbox and on the post's line on the Content page, and HeyCMO remembers them for the next articles it writes. If an AI answer engine stops citing only your competitors for a question you wrote a post for, the Content page says so too. These numbers say what happened, not why: other things change in the same weeks.
• The calendar. Every topic a loop or your pillar plan (PB-05) proposes goes on the editorial calendar on the Content page, once a week however many loops propose it. Drop a topic you do not want; it stays dropped.

Connect Facebook, Instagram, Meta Ads, Google Ads, and Microsoft Advertising (optional)

When your HeyCMO deployment offers it, Settings → Connections → Connect Meta opens Facebook's own login: sign in as an admin of your Facebook Page (and of your ad account, for ads) and keep every permission ticked. Then choose, one at a time, your Page, the Instagram professional account linked to it and your ad account (any of them can be left out: Page only for posting, ad account only for ads). You can also connect Google Ads and Microsoft Advertising (POST /v1/connections/:provider/session with googleads or microsoftads).

• Reads: the paid loops (ad-fatigue, creative-retro, retargeting-hygiene, paid-search-query-mining) see your Google, Meta, LinkedIn, and Microsoft ad campaigns, and the scorecard gets daily spend, clicks, impressions, CTR and conversions.
• Posts (Settings → Channels → Write channels → Social): content repurposing proposes a Facebook post linking to your best page; you edit it in the inbox and approve. The same text is never posted twice to your Page. Photo and Instagram posts use images from HeyCMO's creative studio (signed with C2PA 2.4, with the AI label set for a generated image); an Instagram post cannot be deleted through Instagram's API once published — HeyCMO says so on the card.
• Ads (Write channels → Ad platforms): HeyCMO can pause or resume a campaign or ad set, change daily budgets by at most 30% at a time within your spend caps, add negative/exact keywords, swap fatigued ad creatives with C2PA-signed Creative Studio assets, or shift up to +20% daily budget from a paused fatigued campaign to your highest-converting winner. Nothing changes until you approve.

Optional: Conversions — tell your ad platforms who paid, and see where trials came from

Settings → Connections → Conversions:

• Send-back. Paste a Google Ads conversion action or a LinkedIn conversion rule per type (trial started, first payment, subscription active). HeyCMO then sends each live Stripe trial or payment back to that platform with its click id, or the customer's address hashed, and only with the customer's consent. The deploy runbook (Conversion send-back) has the platform steps.
• Click capture. Copy the snippet onto every page of your site and the server helper into your sign-up and Stripe Checkout code. The snippet keeps the ad click ids and campaign tags a visitor lands with in two cookies on your own site (90 days; none for a browser asking not to be tracked). At sign-up the helper sends the visit to HeyCMO, and at checkout it copies the visitor (heycmo_vid), the click ids and the campaign tags into the subscription's metadata. HeyCMO keeps the visit for 90 days under a one-way token of the visitor id. Using Segment? Send heycmo_vid as an identify trait beside stripeCustomerId and the customer is joined the same way.
• What you get. Send-back uses the visit's Google or LinkedIn click id when Checkout carried none, and the Scorecard shows which channels your trials and new paying customers came from (by the attribution model you pick: Your results), with the ones HeyCMO could not tie to a visit shown as Not attributed.
• Test mode does not count. Only live-mode Stripe events are attributed or sent; test-mode events are ignored.

Connect LinkedIn (Company Page + Founder Member Profile) and X (optional)

When your HeyCMO deployment offers it, Settings → Connections → Connect LinkedIn and sign in as a member who is an administrator of your company Page (Page analytics need that role) and has a campaign manager (or higher) role on your ad account. Then choose the Page and the ad account HeyCMO may use — the only one of each is chosen for you. To post from your personal founder profile (urn:li:person:<subId>), also select your member profile on the LinkedIn connection (PATCH /v1/connections/linkedin with {"personId": "…"} or {"resourceId": "person:<id>"}). You can also connect X (Twitter) (POST /v1/connections/x/session via Nango OAuth 2.0 PKCE with tweet.read tweet.write users.read offline.access) for founder-led X posts (x.publishPost).

What you get:

• Numbers: LinkedIn Page followers, new followers, post impressions, clicks and engagement rate, and LinkedIn Ads impressions, clicks, CTR, cost and conversions, every day on the Scorecard (linkedin.*, linkedinads.*). These are your company Page's numbers: LinkedIn shares no statistics for posts on your own profile with HeyCMO (reading them needs a permission LinkedIn grants approved partners only), so a profile post's card says so instead of showing numbers.
• What each post did: 48 hours after a post HeyCMO staged is published, HeyCMO reads its numbers once — a Page post's impressions and engagement from LinkedIn, an X post's impressions, likes, replies and reposts from X (each X read is billed within your monthly X budget) — and shows them on the post's card, in the Loops drawer and in your track record.
• Founder posts every week: turn on Founder posts in Loops. On Monday it plans the week (2 posts by default, on Tuesday and Thursday; change the number, days and networks in its drawer, What will post this week), picks a topic for each from your editorial calendar, your top pages, news in your space and competitor moves, and drafts each in your voice for your LinkedIn profile (or Page), X or Facebook Page. Each waits in your inbox, naming its planned day: HeyCMO does not schedule posts, so approving one posts it then.
• Post drafts: content-repurposing turns your most-read pages (from Search Console, read weekly: see From a search to a published post) into LinkedIn (Company or Founder Member) and X post drafts (within 280 characters for X), and an inbox report from it, or a post you published to your CMS, can be sent to LinkedIn or X (POST /v1/external-writes/linkedin-drafts, POST /v1/external-writes/x-drafts). Edit the text before you approve. The page's link in a post carries HeyCMO's tracking tags (utm_source=linkedin or x, utm_medium=social, utm_campaign= the page's slug), so a visit from the post counts under Organic Social on the Scorecard; keep the link as it is when you edit (an edit that drops the tags is refused and names the link to keep). HeyCMO never posts the same text and link (or image) twice. An image must be one of your signed creative assets; LinkedIn shows its Content Credentials.
• Campaign proposals: ad-fatigue proposes pausing a LinkedIn campaign with lots of impressions and a very low click rate, or swapping in a fresh signed creative. Budget changes are at most 30% up or down per approval, and a raise must fit your spend caps.

Turn it on like the CMS: Settings → Channels → Write channels → Social (posts) and Ad platforms (campaigns) → accept the terms → Request. Until the HeyCMO operator approves a channel, approving a card only rehearses it — nothing reaches LinkedIn or X.

Optional: connect your CRM (HubSpot, Attio, or Pipedrive — one per workspace)

Settings → Connections → Analytics and ads → connect HubSpot, Attio, or Pipedrive by signing in to it (POST /v1/connections/:provider/session with hubspot, attio, or pipedrive; GET /v1/connections lists connected providers). Attio and Pipedrive are offered only where your HeyCMO deployment has set them up. Each workspace has at most one active CRM; connecting another asks you to confirm the switch:

• Pipeline & Revenue Metrics: Daily HubSpot pipeline metrics (crm.deals_created, crm.deals_won, crm.won_value_cents.<currency>, plus open deals and open pipeline value) show on the Scorecard's Activation and pipeline card. The weekly CMO brief does not read them.
• Account-Aware Lifecycle & Sales-Assist Routing: The lifecycle loops churn-signal, trial-conversion and expansion-upsell read each account's company, owner and recent deals from HubSpot, Attio, or Pipedrive (HubSpot adds the lifecycle stage). An at-risk account with an owner in the CRM (or a high-value one) goes to a person as a churn_escalation card, and a trial sales already works (an owner, an open deal, or a HubSpot SQL or opportunity stage) becomes a trial_escalation card that names who follows up (the account owner, the open deal's owner, or your sales team); neither gets an automated email. An expansion on an account with an open deal is drafted to coordinate with that deal (coordinate-with-open-deal).

Optional: connect Product Analytics (PostHog, Mixpanel, Amplitude, or Segment)

Settings → Connections → Product analytics (POST /v1/connect/{posthog,mixpanel,amplitude}; GET /v1/connect/product-analytics shows what is connected):

• Connect PostHog (Personal API key + project ID + event mapping), Mixpanel (Service Account + project ID), or Amplitude (API key + secret + EU/US region) to feed daily active accounts, activated accounts, and trial starts (product.*) into the Scorecard and Stage 1–2 loops.
• Or send events from Segment as they happen: add HeyCMO as a webhook destination in Segment with the address and secret this panel shows. HeyCMO reads track, identify and group events, and keeps a one-way token of each user id instead of the id.
• Companies looking at your pricing. If your Segment page calls carry the visiting company's domain (from a company-analytics source), HeyCMO counts anonymous visits to your pricing, enterprise, security, docs and integrations pages per company, never per person. With Company intent turned on in Loops, once a company makes 3 or more visits in 24 hours (a visit is one visitor in one hour), HeyCMO looks up its size, industry and country and, when it fits one of your ICP segments (with company size, industries or regions set on the Strategy page), puts a card in your Inbox for your sales team: the pages, what it found about the company and where from, and the CRM owner or open deal if there is one. Approving the card acknowledges it; nothing is sent and nothing is written to your CRM. With Slack connected, the card is also posted there.

Optional: launch posts from your GitHub releases

When you publish a release on GitHub (or merge a changesets "Version Packages" pull request), HeyCMO drafts the launch from your release notes and puts four cards in your inbox (five with the launch video below): a changelog page (a pull request in your site's repository when your CMS is a Git repository; you merge it), a LinkedIn post (in your own voice when LinkedIn is connected), an X thread to post yourself, and a release email for your customers to send from your own email tool. When the creative studio is on, a fifth card is a launch video plan: its scenes with their timing and on-screen words (only the release's own), in 16:9 and 9:16, each with a signed storyboard. HeyCMO renders no video; whoever renders it does so from the plan (approving the card records it as done). Every claim links to the release notes, drafts and pre-releases are skipped, and nothing is published until you approve it. To set it up:

1. Settings → Connections → GitHub releases → Create secret. Copy the secret now: it is shown once.
2. In GitHub, open the repository you release from: Settings → Webhooks → Add webhook.
3. Payload URL: the address the panel shows (…/v1/webhooks/github-release/<your workspace id>). Content type: application/json. Secret: the secret from Sign up and create your workspace.
4. Which events: Let me select individual events → Releases, and Pull requests if you release with changesets. For a changesets monorepo, pick Pull requests alone: one launch per Version Packages merge instead of one per package.
5. Add webhook. GitHub sends a ping; the panel then says GitHub reached HeyCMO, and GitHub's Recent Deliveries shows a 200.

Each release launches once: a redelivery, an edit or publishing it again starts nothing new. If the kill switch is on, your plan is not active, or ten launches already started today, nothing starts and the panel lists the release under Not started with the reason; once that is resolved, open the delivery in GitHub's Recent Deliveries and press Redeliver. The panel lists your latest launches with a link to each run on the Factory page; it updates when you come back to the tab, or press Refresh. A drafted post says only what your release notes say: copy that claims more (a number or a customer count the notes don't have) is replaced by HeyCMO's own draft. Replacing the secret stops the old one at once: paste the new one into the webhook in GitHub.

Optional: connect your own email service provider (Customer.io, Loops, Klaviyo)

If your lifecycle and newsletter email runs in your own ESP, connect it so HeyCMO reads its numbers there instead of only your transactional sender's: Settings → Connections → Email tool — one paste per provider; HeyCMO checks the key with the provider before storing it and never shows it again:

(API: POST /v1/connect/customerio {"appApiKey":"…","region":"us"}, POST /v1/connect/loops {"apiKey":"…"}, POST /v1/connect/klaviyo {"privateKey":"pk_…"}; GET /v1/connect/esp shows what is connected.)

What to expect:

• lifecycle-email-refresh reads the ESP's sequence emails. When one underperforms and HeyCMO can edit it, the inbox card shows the rewritten subject, preheader and the email rendered as recipients see it. Approving applies it once in your ESP. Customer.io automation steps have no draft: the next email that step sends uses the new copy.
• The weekly brief adds your ESP's click, unsubscribe, bounce and complaint rates.
• Nothing reaches your ESP until the HeyCMO operator enables the esp write channel for your workspace (request it in Settings → Channels → Write channels → ESP (Customer.io, Loops)). Before that, approving an ESP card rehearses it: every check runs, nothing is sent.
• A broadcast is a marketing send. POST /v1/esp/customerio/broadcast-triggers {"broadcastId":…, "segmentId":…, "attestation":{…}} stages it with the broadcast's email exactly as it is now; if anyone edits it in Customer.io before you approve, nothing is sent. Consent lives in Customer.io, so you attest to it (and to Customer.io's built-in unsubscribe, your authenticated sender domain, where your footer is and whether AI drafted the copy) — the attestation is part of what you approve. A broadcast is only rehearsed until the marketing policy allows it: the operator allows the ESP broadcast (Customer.io) type, and you opt in to it with your consent basis in the lifecycle email settings (PUT /v1/tenant/marketing-policy/esp_broadcast_send).
• HeyCMO never adds or removes people in your ESP, and never sends a broadcast to named people — only to a segment you already have.

Optional: connect your review sources (G2, App Store, Google Play)

Settings → Connections → Review sites. HeyCMO checks each credential with the provider before storing it and never shows it again:

What to expect:

• review-site-management runs every day. Reviews a source already had when you connected it are history: replies are proposed only for reviews that arrive afterwards (reply to an older one from GET /v1/reviews with POST /v1/reviews/<id>/replies).
• Each proposal is an inbox card with the review — stars, the reviewer's display name, the text — and the reply, drafted in your brand voice. Edit it, approve it or decline it. A reply never offers anything for a review and never asks anyone to change or remove one; HeyCMO refuses such a reply even if you type it.
• Nothing is posted until the HeyCMO operator enables the reviews write channel for your workspace (request it in Settings → Channels → Write channels → Review replies). Before that, approving rehearses the reply.
• If the reviewer edits the review, or someone answers it in App Store Connect or Play Console before you approve, the reply is not posted.

Customer quotes: confirm a customer's permission first

When a happy customer's feedback reaches HeyCMO (the review ask, for example), it keeps their words as a customer quote but quotes them nowhere until you say the customer agreed. Settings → Workspace → Customer quotes lists each quote with its state (Waiting for permission, Permission confirmed, Permission withdrawn, or Words changed: confirm again when the words were edited after you confirmed them). An admin presses Confirm permission, says how the customer agreed (their reply, a signed form or other) and where that is kept; from then on a post or page HeyCMO drafts may quote those exact words. Withdraw permission takes the quote out of every draft still waiting in your Inbox at once; work already approved or published keeps its words. If a draft changed meanwhile, or the removal could not finish, the permission is still withdrawn but the quote stays in those drafts, and the page says so: press Withdraw again to finish (drafts already changed stay changed). Each decision is in the Audit log. (API: GET /v1/testimonials, PUT /v1/testimonials/:id/permission, admin.)

Optional: affiliates, social listening, Canva and hosted landing-page tests

No GA4 (or other data source) yet? Settings → Advanced also has a Data for loops panel — paste tracking/activity JSON there to feed the hybrid loops server-side (PUT /v1/ingest/:kind). Prefer real secrets when you have them.

Optional: press requests and podcast guest spots (the Press page)

The Press page (under Grow) is the journalist desk. Turn on the journalist desk in Loops, then:

• Journalist requests. Set a filter in your mailbox that forwards your HARO, Featured, Qwoted, Source of Sources and MentionMatch digests to the desk address the page shows (Copy address), and list under Where you forward from the mailboxes (or your company domain) you forward from: only mail forwarded from them is read. Add Extra topics if you want more than your product context matched. The page lists the requests, and each one that fits your product becomes a card of facts to write from: the request, why it matched, your product's facts and numbers, talking points and how to reply. You write and send the answer yourself on the service; HeyCMO sends nothing. Mark what came of an answer (sent, quoted, the link to the piece) on the page. A request is deleted a week after its deadline, and no journalist's name or address is kept. (API: GET /v1/journalist-desk, PUT /v1/journalist-desk.)
• Podcast guest spots. Where your HeyCMO deployment has a podcast search provider set up, the desk also searches recent podcast episodes once a day for your competitors (from Settings → Listening and the Strategy page) and your desk topics. When a show complains about a competitor's pricing or reliability, or discusses what your product solves, at a moment its transcript dates, you get a card with the show and episode, what was said and when, and facts from your product context to pitch yourself as a guest. HeyCMO contacts no show. For an episode found through Listen Notes, the card keeps only the episode's id and date (Listen Notes' terms): press Show the episode to read the rest from Listen Notes when you open it, which uses one search from your workspace's monthly budget. The search stops while listening is off.