Connections and credentials

A connection holds what a block needs to sign in to another system: an API key, a username and password, an OAuth sign-in, a mailbox or a storage bucket. Blocks refer to a connection by name, so the secret is stored once and never appears in an automation’s settings.

Connections belong to a workspace. Find them under Connections in the workspace rail.

Add a connection

1. Open Connections and click New connection.
2. In Choose a connection, pick the kind you need. Search by provider or capability, or browse the tabs: AI, APIs and authentication, OAuth, Email, Observability and MCP. Connections from installed packages appear under Other installed connections.
3. Give it a Connection name and fill in the fields that kind asks for.
4. Click Save connection. For a kind that signs in through another site, click Connect instead and finish the sign-in in the window that opens. You never type a token for those.

Saving checks that the fields are filled in correctly. It does not prove the other system accepts them. Some kinds have a test of their own, such as Test connection for object storage. Otherwise, a live run of a block that uses the connection is the real check. A draft run holds writes, so it does not prove them.

Use a connection in a block

Blocks that call another system, such as HTTP Request or Read S3 object, have a connection setting. Pick a connection from the list. Only connections of a kind the block accepts can be chosen, and disabled connections are shown but cannot be picked. When the workspace has none the block accepts, the list is disabled and reads No compatible connections: add one under Connections in the workspace rail.

Secrets stay secret

Once saved, a secret cannot be read back, not even by the person who entered it. To change one, open the connection’s menu and choose Replace credentials, then enter the whole configuration again. Run details also leave secrets out.

From the same menu you can Disable connection, Disconnect OAuth, or Delete connection. Blocks that used a deleted connection need a new one picked before they run.

The status column shows whether a connection is ready, for example Connected, Expired or Authorization revoked. Expired and revoked connections need to be signed in again.

Who can manage connections

Creating, replacing and deleting connections needs the Workspace lead role, or Organization admin or Operations director. Anyone who can see the workspace’s automations can see its connections, but never their secret values.

Next

• Connect your systems: which connection an AI provider, a TMS or a customs portal needs.
• Build your first automation
• Triggers: the Email received trigger reads a mailbox connection.