diff --git a/src/routes/integrations.js b/src/routes/integrations.js
index 07abeec..008d10b 100644
--- a/src/routes/integrations.js
+++ b/src/routes/integrations.js
@@ -139,6 +139,19 @@ export async function integrationRoutes(app) {
     return value
   })
 
+  // GET /settings/api/internal/integration/:slug — service-to-service, no user session required
+  // Authenticated by SETTINGS_SECRET bearer token; returns unmasked credentials.
+  app.get('/internal/integration/:slug', async (req, reply) => {
+    const token = (req.headers.authorization || '').replace(/^Bearer\s+/i, '')
+    if (!token || token !== process.env.SETTINGS_SECRET) {
+      return reply.status(401).send({ error: 'Unauthorized' })
+    }
+    const { rows: [row] } = await pool.query('SELECT * FROM integrations WHERE slug = $1', [req.params.slug])
+    if (!row) return reply.status(404).send({ error: 'Integration not found' })
+    if (!row.enabled) return reply.status(403).send({ error: 'Integration is disabled' })
+    return { ...row.config, ...decryptSecrets(row) }
+  })
+
   // PUT /settings/api/integrations/newbook/rooms — save reorder + colour changes
   app.put('/integrations/newbook/rooms', { preHandler: requireAdmin }, async (req, reply) => {
     const { rows: [row] } = await pool.query(`SELECT value FROM global_config WHERE key = 'newbook.rooms'`)