nora connectors

Connectors are named, encrypted credentials for external systems. Configure once at the workspace level; reference by ID from any Foundry pipeline, Tool, or Trigger that needs the credentials.

Commands

Command	Description
`connectors list`	List all connectors in the workspace.
`connectors get <id>`	Print connector config (secrets masked).
`connectors create`	Create a new api-key connector.
`connectors update <id>`	Rename or rotate the key.
`connectors delete <id>`	Remove a connector.
`connectors invoke <id> <operation>`	Call an operation via the connector.

`connectors list` / `get`

nora connectors list
nora connectors get c_tavily

list gives one row per connector. get prints config with secrets masked.

`connectors create`

nora connectors create \
  --provider tavily \
  --name "Tavily search" \
  --api-key ?
# --api-key ? prompts (masked input)

Flags:

--provider <p> (required) — the external system. Supported: tavily, brave (extending).
--name <n> (required) — display name.
--api-key <key> (required) — the API key. Use ? for a masked prompt, - to read from stdin, or pass the literal (with a shell-history warning).

Prints the new connector’s ID. Prefer ? or stdin over passing the literal — literal API keys land in your shell history.

`connectors update`

# Rename
nora connectors update c_tavily --set-name "Tavily (production)"

# Rotate the API key
nora connectors update c_tavily --rotate-api-key ?

Flags:

--set-name <n> — new display name.
--rotate-api-key <key> — replace the stored key. Same input modes as create (?, -, literal).

Only flags passed change.

`connectors delete`

nora connectors delete c_tavily

Fails if any pipeline, Tool, or Trigger references the connector. Update those first.

`connectors invoke`

nora connectors invoke c_tavily search \
  --arg query="what is a causal graph" \
  --arg limit=5

Calls a specific operation the connector supports. Every provider exposes different operations — see the connector’s docs (or connectors get for the list). Flags:

<id> — connector.
<operation> — operation name (e.g. search, list_channels).
--arg KEY=VALUE — one arg per flag, or:
--json <json> — full args as JSON.

Common uses:

Smoke-test that a rotated key works: nora connectors invoke c_tavily search --arg query=test.
Ad-hoc data pull without wiring into a Flow.

Recipes

Rotate credentials in a script

# Read new key from a file securely
cat new-key.txt | nora connectors update c_tavily --rotate-api-key -

Old key stays valid for 60 minutes to allow zero-downtime rotation.

Verify all connectors still work

for c in $(nora connectors list --json | jq -r '.[].id'); do
  echo "Testing $c..."
  nora connectors invoke $c ping 2>&1 | grep -q "ok" && echo "  OK" || echo "  FAIL"
done

(Operations vary by provider — ping is illustrative; check what each provider supports.)

Migrate a connector to another workspace

# Read from source
key=$(cat ~/.nora-keys/tavily)

# Create in destination
nora --workspace destination connectors create \
  --provider tavily \
  --name "Tavily" \
  --api-key "$key"

Connectors vs. secrets

Connectors are typed integrations for specific systems (Tavily, Brave, …). The connector knows the API shape.
Secrets are opaque string values (used in Tool headers, Trigger auth, DB URLs). No typed shape.

For a generic HTTP integration, use a Tool with a secrets:// header. For a well-known provider (search, embeddings, etc.), use a Connector. Both are workspace-scoped and encrypted at rest.

Referencing a connector

From a Tool that needs a connector’s key:

nora tools headers add t_search \
  --name Authorization \
  --value "secrets://connector:c_tavily/api_key"

The tool interpolates the key at call time — never at edit time.

Access

Any workspace member can list connectors and see names. Only Managers and Owners can create, rotate, or delete. The actual key value is never returned to any user through the CLI or app.

Deletion audit

Every deletion is logged (see Audit trail). If a connector was accidentally deleted, the referenced Tools/pipelines that broke are the fastest way to detect it — they’ll error on next run with “connector not found”.

Setup

Flows

Blocks

Data & knowledge

Reliability

Workspace

Reference

nora connectors

Commands

`connectors list` / `get`

`connectors create`

`connectors update`

`connectors delete`

`connectors invoke`

Recipes

Rotate credentials in a script

Verify all connectors still work

Migrate a connector to another workspace

Connectors vs. secrets

Referencing a connector

Access

Deletion audit

​Commands

​connectors list / get

​connectors create

​connectors update

​connectors delete

​connectors invoke

​Recipes

​Rotate credentials in a script

​Verify all connectors still work

​Migrate a connector to another workspace

​Connectors vs. secrets

​Referencing a connector

​Access

​Deletion audit

Commands

`connectors list` / `get`

`connectors create`

`connectors update`

`connectors delete`

`connectors invoke`

Recipes

Rotate credentials in a script

Verify all connectors still work

Migrate a connector to another workspace

Connectors vs. secrets

Referencing a connector

Access

Deletion audit