Using API v1? See what changes in v2, or the v1 docs

Build with Bolt

Bolt's agent can add Google Calendar and Microsoft Outlook to your app with Pyas. You connect the Pyas MCP server to Bolt once. The agent then gets the code for each task from Pyas, and you store a key as a secret. The key stays on the server, and the code works with the sandbox's sample people before anyone connects a real calendar.

Add Pyas to Bolt

  1. On the Bolt home page, select the + icon in the chat box, then Connectors, then Manage connectors.
  2. Select Custom MCP server.
  3. For Name, enter Pyas. For URL, enter https://mcp.pyas.io/sandbox. Set Transport type to HTTP and Authentication to MCP OAuth.
  4. Select Connect. Sign in to Pyas, choose your app, and select Allow. See Sign in for what each permission allows.
  5. Turn the connector on for your project: select +, then Connectors, and turn on Pyas. To turn it on for every new project, use Auto-enable for all projects.

Only a project's owner can connect MCP servers to it. To remove Pyas, open Manage connectors, select Pyas, then the three dots, then Delete.

Ask for what you want

Ask in plain words, for example:

Add a button that lets people connect their Google or Outlook calendar, and show their events for the next week.

The agent checks your setup with setup_status and gets the code for each task with get_recipe. It adds your app's preview address to the allowed origins with update_app, and creates a test key with get_test_key. You confirm the address in Pyas, from the link it gives you. Every response from Pyas ends with the next step, so the agent knows what to do next.

Store the key

Store the test key as a secret named PYAS_API_KEY:

  • In Bolt: select the database icon, then Secrets. Enter the name and the key, and select Save. The project needs a database first, and only its owner can add secrets.
  • In a project that uses your own Supabase project: add it in the Supabase dashboard, under your project's Edge Functions secrets.

Don't put the key in the chat or in a VITE_ variable: those reach the browser. A test key works only in your app's sandbox.

What Bolt adds

The code is written as Supabase Edge Functions, for projects that use Supabase:

supabase/functions/_shared/pyas.ts                the Pyas client, shared by the functions
supabase/functions/pyas-connect-session/index.ts  creates a connect session for the button
supabase/functions/pyas-events/index.ts           the person's events for the next 7 days
supabase/functions/pyas-book/index.ts             books the first free 30 minutes tomorrow
src/components/ConnectCalendar.tsx                the "Connect an account" button

The button imports the project's Supabase client, so the agent points that import at the file where your project creates it. Your pages call the functions with that client, for example supabase.functions.invoke('pyas-events').

With a test key, the functions use the sandbox's sample person, so the events and booking work right away. The connect button shows a message from Pyas that connecting a real calendar requires a live key. This is expected.

Receive webhooks

Ask the agent to receive Pyas webhooks. It adds pyas-webhooks/index.ts to your functions, and turns off the Supabase sign-in check for that function in supabase/config.toml, because the function verifies the signature of each delivery instead:

[functions.pyas-webhooks]
verify_jwt = false

The agent adds the endpoint to your sandbox with create_webhook, at the function's public address. In Bolt, the address is listed under the database icon, in Server Functions. Store the signing secret that create_webhook returns as a secret named PYAS_WEBHOOK_SECRET. See Webhooks for the events Pyas sends.

Go live

  1. In the Pyas dashboard, choose a plan and create a live key. Plans, payment and live keys are always done by you, in the dashboard.
  2. Replace the PYAS_API_KEY secret with the live key.
  3. The functions now use the signed-in Supabase user. People who aren't signed in get a 401 response with the code SIGN_IN_REQUIRED, so your app needs sign-in before people connect a calendar.
  4. Add your published address, such as https://your-app.bolt.host, to the app's allowed origins, and add a live webhook endpoint in the dashboard.