`runs/businessclaw-2026-05-05-2018/hub.html`

149 lines
<!doctype html>
<html lang="en"><head>
<meta charset="utf-8" /><meta name="viewport" content="width=device-width,initial-scale=1" />
<title>Info Hub — businessclaw.agentabrams.com</title>
<meta name="robots" content="noindex" />
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Cormorant+Garamond:ital,wght@0,400;0,500;0,600;1,400;1,500&family=Inter:wght@300;400;500;600&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">
<style>
:root{--ink:#f4f1ea;--ink-soft:rgba(244,241,234,.78);--ink-mute:rgba(244,241,234,.52);--bg:#0e0e10;--bg-elevated:#16161a;--bg-card:rgba(244,241,234,.04);--rule:rgba(244,241,234,.10);--gold:#d4a04a;--gold-soft:rgba(212,160,74,.14);--good:#8fb89a;--bad:#c9856e;--warn:#d9b577;--serif:"Cormorant Garamond",Georgia,serif;--sans:"Inter",system-ui,sans-serif;--mono:"JetBrains Mono",ui-monospace,Menlo,monospace}
*{box-sizing:border-box}
html,body{margin:0;background:var(--bg);color:var(--ink);font-family:var(--sans)}
body::before{content:"";position:fixed;inset:0;background:radial-gradient(ellipse 80% 60% at 18% -10%,rgba(212,160,74,.06),transparent 60%);pointer-events:none;z-index:0}
.nav{position:sticky;top:0;background:rgba(14,14,16,.86);backdrop-filter:blur(8px);border-bottom:1px solid var(--rule);padding:14px 32px;display:flex;gap:20px;font-family:var(--mono);font-size:10px;letter-spacing:.16em;text-transform:uppercase;z-index:9}
.nav a{color:var(--ink-mute);text-decoration:none}.nav a:hover,.nav .home{color:var(--gold)}
main{position:relative;z-index:1;max-width:1100px;margin:0 auto;padding:64px 32px 96px}
.eyebrow{font-family:var(--mono);font-size:10px;letter-spacing:.22em;text-transform:uppercase;color:var(--gold);margin-bottom:18px}
h1{font-family:var(--serif);font-weight:500;font-size:60px;line-height:1.05;letter-spacing:-.02em;margin:0 0 12px}
h1 em{font-style:italic;color:var(--gold)}
.lede{font-family:var(--serif);font-style:italic;font-size:20px;line-height:1.5;color:var(--ink);max-width:62ch;margin:0 0 36px}
h2{font-family:var(--serif);font-weight:500;font-size:30px;margin:48px 0 8px;border-top:1px solid var(--rule);padding-top:32px}
h2 em{font-style:italic;color:var(--gold)}
table{width:100%;border-collapse:collapse;font-size:13px;margin:18px 0}
th,td{padding:11px 12px;border-bottom:1px solid var(--rule);text-align:left;vertical-align:top}
th{font-family:var(--mono);font-size:10px;letter-spacing:.14em;text-transform:uppercase;color:var(--ink-mute);font-weight:500}
td a{color:var(--gold);text-decoration:none}
td a:hover{text-decoration:underline}
td .sub{display:block;font-size:11px;color:var(--ink-mute);margin-top:3px}
.tag{display:inline-block;font-family:var(--mono);font-size:9px;letter-spacing:.14em;padding:3px 7px;border-radius:2px;background:var(--gold-soft);color:var(--gold);text-transform:uppercase}
.tag.good{background:rgba(143,184,154,.16);color:var(--good)}
.tag.warn{background:rgba(217,181,119,.16);color:var(--warn)}
.tag.bad{background:rgba(201,133,110,.16);color:var(--bad)}
</style></head>
<body>
<nav class="nav">
  <a href="index.html" class="home">Commerce Claw — Audit Hub</a>
  <a href="report.html">Audit</a>
  <a href="peers.html">Peers</a>
  <a href="competitors.html">Competitors</a>
  <a href="mockups/index.html">Mockups</a>
  <a href="tools.html">Tools</a>
  <a href="hub.html">Info Hub</a>
  <a href="extension.html">Extension</a>
</nav>
<main>
  <div class="eyebrow">Info Hub · Section 06 of 07</div>
  <h1>Authoritative sources for the <em>SaaS-automation</em> vertical.</h1>
  <p class="lede">A curated directory of the standards, references, marketplaces, security guides, and SMB-policy pages that anyone building a 56-connector SaaS-automation tool should know about. Direct links to actual documents, not category homepages.</p>

  <h2>Connector API references · <em>the 12 most-used</em></h2>
  <table>
    <thead><tr><th>Tool</th><th>Direct doc URL</th><th>Auth model</th><th>Webhook standard</th><th>Rate limit (entry tier)</th></tr></thead>
    <tbody>
      <tr><td>Stripe</td><td><a href="https://docs.stripe.com/api">docs.stripe.com/api</a><span class="sub">Best-in-class reference. Use as design north-star.</span></td><td>Bearer · restricted keys</td><td>Signed (HMAC SHA-256)</td><td>~100 r/s</td></tr>
      <tr><td>Shopify</td><td><a href="https://shopify.dev/docs/api/admin">shopify.dev/docs/api/admin</a><span class="sub">REST + GraphQL. GraphQL preferred for new code.</span></td><td>OAuth · access tokens</td><td>Signed</td><td>2 r/s standard</td></tr>
      <tr><td>Slack</td><td><a href="https://api.slack.com/methods">api.slack.com/methods</a></td><td>OAuth · bot tokens</td><td>Events API</td><td>Tier 2: 20 r/min</td></tr>
      <tr><td>Notion</td><td><a href="https://developers.notion.com/reference/intro">developers.notion.com/reference</a></td><td>OAuth · internal-int tokens</td><td>None native (poll)</td><td>3 r/s avg</td></tr>
      <tr><td>HubSpot</td><td><a href="https://developers.hubspot.com/docs/api/overview">developers.hubspot.com/docs/api</a></td><td>OAuth · private apps</td><td>Webhooks</td><td>100 r/10s</td></tr>
      <tr><td>Discord</td><td><a href="https://discord.com/developers/docs/intro">discord.com/developers/docs</a></td><td>OAuth · bot tokens</td><td>Gateway WS + interactions</td><td>50 r/s global</td></tr>
      <tr><td>Cloudflare</td><td><a href="https://developers.cloudflare.com/api/">developers.cloudflare.com/api</a></td><td>API tokens (scoped)</td><td>Notifications API</td><td>1,200 r/5min</td></tr>
      <tr><td>Twilio</td><td><a href="https://www.twilio.com/docs/usage/api">twilio.com/docs/usage/api</a></td><td>Account SID + auth token</td><td>Webhooks</td><td>Messaging: 1 msg/s</td></tr>
      <tr><td>SendGrid</td><td><a href="https://www.twilio.com/docs/sendgrid/api-reference">twilio.com/docs/sendgrid/api-reference</a></td><td>API keys</td><td>Event Webhook</td><td>600 r/min</td></tr>
      <tr><td>Square</td><td><a href="https://developer.squareup.com/reference/square">developer.squareup.com/reference/square</a></td><td>OAuth · access tokens</td><td>Webhook subscriptions</td><td>10 r/s default</td></tr>
      <tr><td>QuickBooks</td><td><a href="https://developer.intuit.com/app/developer/qbo/docs/api/accounting/all-entities/account">developer.intuit.com/app/developer/qbo/docs</a></td><td>OAuth 2.0</td><td>Webhooks (limited)</td><td>500 r/min</td></tr>
      <tr><td>Calendly</td><td><a href="https://developer.calendly.com/api-docs">developer.calendly.com/api-docs</a></td><td>OAuth + PATs</td><td>Webhooks</td><td>1,000 r/hr</td></tr>
    </tbody>
  </table>
  <p style="font-size:13px;color:var(--ink-mute)"><em>Verified against each provider's published docs. Confirm rate limits and auth scopes against current docs before shipping.</em></p>

  <h2>Standards &amp; <em>protocols</em> worth knowing</h2>
  <table>
    <thead><tr><th>Standard</th><th>What it is</th><th>Why Commerce Claw cares</th></tr></thead>
    <tbody>
      <tr><td><a href="https://datatracker.ietf.org/doc/html/rfc6749">OAuth 2.0 (RFC 6749)</a></td><td>Authorization framework</td><td>Default auth for ~80% of the 56 connectors. Implement once, support all.</td></tr>
      <tr><td><a href="https://datatracker.ietf.org/doc/html/rfc7515">JWT (RFC 7515)</a></td><td>JSON Web Tokens</td><td>Used by Slack events, several others. Verify signatures correctly.</td></tr>
      <tr><td><a href="https://www.w3.org/TR/webauthn-2/">WebAuthn (W3C)</a></td><td>Passwordless auth</td><td>Roadmap option for Commerce Claw login itself; reduce password attack surface.</td></tr>
      <tr><td><a href="https://www.modelcontextprotocol.io/">Model Context Protocol</a></td><td>Anthropic's open standard for LLM↔tools</td><td>Long-term: ship Commerce Claw connectors as MCP servers. Future-proofs the routing layer.</td></tr>
      <tr><td><a href="https://openapi.tools/">OpenAPI 3.x</a></td><td>API description format</td><td>Most modern connectors publish OpenAPI; auto-generate Commerce Claw routing schemas from it.</td></tr>
      <tr><td><a href="https://www.iana.org/assignments/media-types/media-types.xhtml">IANA Media Types</a></td><td>Authoritative MIME registry</td><td>Correct content-type handling on file uploads across Drive/Box/Dropbox/OneDrive.</td></tr>
    </tbody>
  </table>

  <h2>Security &amp; <em>compliance</em> references</h2>
  <table>
    <thead><tr><th>Source</th><th>What's there</th><th>Status</th></tr></thead>
    <tbody>
      <tr><td><a href="https://owasp.org/www-project-top-ten/">OWASP Top 10</a></td><td>Web app vulnerability list (2021)</td><td><span class="tag good">required reading</span></td></tr>
      <tr><td><a href="https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html">OWASP Cryptographic Storage Cheat Sheet</a></td><td>How to do AES-256-GCM correctly</td><td><span class="tag good">canonical</span></td></tr>
      <tr><td><a href="https://csrc.nist.gov/pubs/sp/800/63/4/2pd">NIST SP 800-63B</a></td><td>Digital Identity Guidelines</td><td><span class="tag good">authority</span></td></tr>
      <tr><td><a href="https://www.cisa.gov/secure-by-design">CISA · Secure by Design</a></td><td>Software security principles</td><td><span class="tag good">government baseline</span></td></tr>
      <tr><td><a href="https://oag.ca.gov/privacy/ccpa">California CCPA / CPRA (CA AG)</a></td><td>Consumer-data law text + FAQs</td><td><span class="tag warn">applies if any CA user</span></td></tr>
      <tr><td><a href="https://gdpr.eu/">GDPR (gdpr.eu)</a></td><td>EU regulation primer</td><td><span class="tag warn">applies if EU users</span></td></tr>
      <tr><td><a href="https://content-security-policy.com/">CSP reference</a></td><td>Content-Security-Policy directives</td><td><span class="tag good">good</span></td></tr>
      <tr><td><a href="https://hstspreload.org/">HSTS Preload</a></td><td>Submit domain for preload list</td><td><span class="tag good">submit when ready</span> · CC already meets criteria</td></tr>
      <tr><td><a href="https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search">NIST SP 800-53</a></td><td>Security &amp; privacy controls catalog</td><td><span class="tag warn">SOC 2 prep</span></td></tr>
    </tbody>
  </table>

  <h2>SMB context · <em>who you're selling to</em></h2>
  <table>
    <thead><tr><th>Source</th><th>What's there</th></tr></thead>
    <tbody>
      <tr><td><a href="https://www.sba.gov/business-guide">SBA · Business Guide</a></td><td>Definitive US small-business categorization &amp; resources. Use SBA size standards for "SMB" claims.</td></tr>
      <tr><td><a href="https://www.census.gov/programs-surveys/susb.html">US Census · Statistics of US Businesses</a></td><td>Headcount &amp; revenue distributions by industry — sizing math for your wedge.</td></tr>
      <tr><td><a href="https://www.bls.gov/iag/tgs/iag00.htm">BLS · Industries at a Glance</a></td><td>Per-industry employment, wages, productivity. Build vertical packs from here.</td></tr>
      <tr><td><a href="https://nfib.com/research/">NFIB Small Business Optimism Index</a></td><td>Monthly SMB sentiment data; useful for content + market timing claims.</td></tr>
      <tr><td><a href="https://www.uschamber.com/small-business/start-a-business">US Chamber · Small Business Resources</a></td><td>Authoritative SMB content; useful linking out, less for in-product use.</td></tr>
    </tbody>
  </table>

  <h2>Competitor docs &amp; <em>marketplaces</em></h2>
  <table>
    <thead><tr><th>Source</th><th>What's there</th></tr></thead>
    <tbody>
      <tr><td><a href="https://zapier.com/apps">Zapier App Directory</a></td><td>~7,000 apps. Use as taxonomy reference; Commerce Claw's curated 56 should map cleanly.</td></tr>
      <tr><td><a href="https://docs.n8n.io/integrations/builtin/app-nodes/">n8n nodes catalog</a></td><td>~400 open-source integration definitions. Reusable schema patterns.</td></tr>
      <tr><td><a href="https://pipedream.com/apps">Pipedream apps</a></td><td>~2,500 apps + community-contributed components. SDK pattern reference.</td></tr>
      <tr><td><a href="https://docs.bardeen.ai/">Bardeen docs</a></td><td>Closest UX peer. Borrow vocabulary ("playbook", "scraper", "trigger").</td></tr>
      <tr><td><a href="https://www.make.com/en/integrations">Make integrations</a></td><td>Visual canvas paradigm reference.</td></tr>
    </tbody>
  </table>

  <h2>SEO &amp; <em>discoverability</em> tools</h2>
  <table>
    <thead><tr><th>Source</th><th>What's there</th><th>Why</th></tr></thead>
    <tbody>
      <tr><td><a href="https://search.google.com/search-console">Google Search Console</a></td><td>Crawl + indexation diagnostics</td><td>Verify domain, watch the login wall stop being the top page once mockup ships</td></tr>
      <tr><td><a href="https://web.dev/measure/">web.dev Measure</a></td><td>Lighthouse on demand</td><td>Track perf as homepage grows beyond 4 KB</td></tr>
      <tr><td><a href="https://search.google.com/test/rich-results">Rich Results Test</a></td><td>JSON-LD validation</td><td>CC's SoftwareApplication schema already passes; re-test as marketing pages added</td></tr>
      <tr><td><a href="https://schema.org/SoftwareApplication">schema.org/SoftwareApplication</a></td><td>Schema reference</td><td>Already implemented on /login. Extend to per-connector pages.</td></tr>
      <tr><td><a href="https://developers.google.com/search/docs/specialty/saas">Google · SaaS site SEO guide</a></td><td>Google's own SaaS SEO recommendations</td><td>Direct from the source</td></tr>
    </tbody>
  </table>

  <h2>Privacy-first <em>analytics</em> options</h2>
  <table>
    <thead><tr><th>Tool</th><th>Mode</th><th>Why for CC</th></tr></thead>
    <tbody>
      <tr><td><a href="https://plausible.io/">Plausible</a></td><td>Hosted EU + self-host</td><td>No cookies, no PII, GDPR/CCPA-compliant by default. Light enough for the editorial brand.</td></tr>
      <tr><td><a href="https://umami.is/">Umami</a></td><td>Self-host</td><td>Open-source. ~6 KB script. Fits CC's "small, restrained" aesthetic.</td></tr>
      <tr><td><a href="https://posthog.com/">PostHog</a></td><td>Hosted + self-host</td><td>Heavier; only if Commerce Claw needs funnel/retention analytics on the product side.</td></tr>
      <tr><td><a href="https://marketingplatform.google.com/about/analytics/">Google Analytics 4</a></td><td>Hosted</td><td>Steve already has 16 GA4 properties under accounts/371997142 — fits the existing fleet pattern. <span class="sub">Reference: <code>ga-analytics-agent/properties.json</code></span></td></tr>
    </tbody>
  </table>

  <p style="font-family:var(--mono);font-size:11px;letter-spacing:.12em;color:var(--ink-mute);text-transform:uppercase;margin-top:48px">End · Info Hub · 6 of 7. Next → <a href="extension.html" style="color:var(--gold)">Chrome Extension</a></p>
</main>
</body></html>