API Settings

Firecrawl, Tavily, SearXNG, and OpenStreetMap Overpass power deterministic, evidence-based research and lead discovery without LLMs. SMTP sends email only after explicit confirmation.

Secrets stay server-side and are never rendered back

SearXNG Search Engine — Private Metasearch Provider

Local or private SearXNG instance providing multi-engine web search without third-party API fees or tracking. Configurable endpoint with an ON/OFF toggle. OFF stops all requests to SearXNG.
Disconnected

Toggle SearXNG search ON or OFF. When OFF, Northstar will not send search queries to SearXNG and will rely on Firecrawl, Tavily, and OpenStreetMap.

Base URL of your self-hosted SearXNG instance (e.g. https://searx.yourdomain.com). Note: http://127.0.0.1:8888 is only for local dev servers. On shared hosting like Hostinger, keep SearXNG OFF unless you have an external SearXNG server URL.

Firecrawl Search — preferred web discovery fallback

Firecrawl searches the public web for candidate business sources. Northstar then validates the official website, campaign locality, business focus, and publicly listed contact details before it saves a lead. It does not invent companies, contacts, or sources.
Connected

Paste your Firecrawl dashboard key here. Save Settings first, then run the connection test. The actual key is never rendered back to the browser.

Lead discovery only: Firecrawl’s Search API returns public result URLs, titles, and descriptions. Northstar uses those as evidence, checks qualifying official business pages for public contacts, and labels saved records for review before outreach.

When configured, Firecrawl is used before Tavily for source-backed fallback research. No email is sent by searching.

Tavily Search — free grounded fallback

Uses Tavily’s returned public URLs and snippets, then your working base Gemini API to structure candidate leads. It is attempted after the Gemini/OpenAI grounded path fails.
Connected

Paste your Tavily dashboard key here. After Save Settings it will show only “Saved securely”; the actual key is never rendered back.

Use Basic for free-plan testing. This app saves only exact URLs returned by Tavily, and still checks each source before retaining public contact details.

OpenStreetMap Overpass API — Free Mapped Business Discovery

Directly queries public OpenStreetMap Overpass servers to discover real geolocated business entities, clinics, and offices for your campaign location. No API key or credentials required. Complies with OSM Acceptable Use Policies and includes ODbL attribution.
Connected

Public interpreter endpoint (defaults to https://overpass.maprva.org/api/interpreter with automatic failover to overpass.osm.ch and community mirrors).

seconds
Zero API keys needed: Queries bounding boxes geocoded via OpenStreetMap Nominatim. Results are cached for 24 hours to respect community server resources. Mapped data is attributed to © OpenStreetMap contributors under the ODbL license.

SMTP / Email

Email is delivered only through the server-side SMTP handler after explicit final confirmation.
Connected

Leave blank to retain the saved password.

Test saved connections

Tests use the saved server-side values. Errors are shown on this page; credentials are never returned. A successful SMTP delivery test means the SMTP server accepted the message, not that an inbox has read it.

SearXNG Local Search Engine

Sends a test search query to your configured SearXNG endpoint and verifies JSON results without writing leads.

Firecrawl Search fallback

Runs one real Firecrawl Search request and requires returned public source URLs. This verifies the saved key; it does not create leads or send email.

Tavily Search fallback

Runs one real Tavily basic search and requires returned public source URLs. This tests the no-cost search fallback; it does not send email or create leads.

OpenStreetMap Overpass

Sends a bounded query to the configured Overpass interpreter endpoint and verifies JSON node responses. No API key or credentials required.

SMTP connection & authentication

Connects, negotiates TLS when configured, and authenticates with the saved username and app password. It does not send an email.

Send real SMTP test email

This invokes the configured SMTP server and sends one message. It does not start a campaign or contact any lead.

Local credential note

UI-saved credentials are persisted server-side in the local application database and kept in a Git-ignored config/local.php compatibility fallback, with local owner-only permissions where supported. This local demo does not provide encryption at rest; use dedicated credentials on a trusted machine. Gemini, OpenAI, Firecrawl, Tavily, and SMTP secrets are never written to message logs or returned to the browser.