Skip to main content
A Connector is a saved credential for an external system. Once you set one up, any pipeline in the workspace can use it — no re-authing per pipeline.

​
Available connectors

More are added regularly — check the connector picker in the app for the current set.

​
Creating a connector

  1. Settings → Connectors → New.
  2. Pick the system.
  3. Auth via OAuth (most systems) or paste credentials directly (databases, S3, generic HTTP).
  4. Give it a memorable name.
  5. Optionally scope it to specific folders, buckets, or channels — narrower scopes reduce accidental exposure.
Once saved, credentials are encrypted at rest. The UI never shows the raw value again.

​
Using a connector

In any Source block, pick the connector from the dropdown. The block will surface config specific to that system (which folder, which channel, which SQL, etc).

​
Testing

Every Connector has a Test button that runs a read-only probe (list a folder, count messages in a channel, run SELECT 1). Green means credentials are valid.

​
Rotating credentials

Settings → Connectors → [name] → Rotate. Old credentials keep working for a 60-minute grace period so in-flight pipelines don’t fail.

​
Least privilege

  • OAuth connectors default to the narrowest scope that satisfies read-only access.
  • For databases, create a Nora-only user with SELECT on specific schemas.
  • For S3, use an IAM policy scoped to a single prefix.

​
Deletion

Deleting a connector fails if any pipeline still references it. Update the pipelines first, then delete.

​
Custom auth

For systems not listed, use the HTTP (generic) connector. It supports API key, bearer, basic, and OAuth 2.0 client-credentials. You can also inject signed headers via a small pre-request script.