> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# nora connectors

> Manage reusable external-system credentials — API keys, rotation, invocation.

Connectors are named, encrypted credentials for external systems. Configure once at the workspace level; reference by ID from any Foundry pipeline, Tool, or Trigger that needs the credentials.

## Commands

| Command                              | Description                              |
| ------------------------------------ | ---------------------------------------- |
| `connectors list`                    | List all connectors in the workspace.    |
| `connectors get <id>`                | Print connector config (secrets masked). |
| `connectors create`                  | Create a new api-key connector.          |
| `connectors update <id>`             | Rename or rotate the key.                |
| `connectors delete <id>`             | Remove a connector.                      |
| `connectors invoke <id> <operation>` | Call an operation via the connector.     |

## `connectors list` / `get`

```bash theme={null}
nora connectors list
nora connectors get c_tavily
```

`list` gives one row per connector. `get` prints config with secrets masked.

## `connectors create`

```bash theme={null}
nora connectors create \
  --provider tavily \
  --name "Tavily search" \
  --api-key ?
# --api-key ? prompts (masked input)
```

Flags:

* `--provider <p>` (required) — the external system. Supported: `tavily`, `brave` (extending).
* `--name <n>` (required) — display name.
* `--api-key <key>` (required) — the API key. Use `?` for a masked prompt, `-` to read from stdin, or pass the literal (with a shell-history warning).

Prints the new connector's ID.

Prefer `?` or stdin over passing the literal — literal API keys land in your shell history.

## `connectors update`

```bash theme={null}
# Rename
nora connectors update c_tavily --set-name "Tavily (production)"

# Rotate the API key
nora connectors update c_tavily --rotate-api-key ?
```

Flags:

* `--set-name <n>` — new display name.
* `--rotate-api-key <key>` — replace the stored key. Same input modes as create (`?`, `-`, literal).

Only flags passed change.

## `connectors delete`

```bash theme={null}
nora connectors delete c_tavily
```

Fails if any pipeline, Tool, or Trigger references the connector. Update those first.

## `connectors invoke`

```bash theme={null}
nora connectors invoke c_tavily search \
  --arg query="what is a causal graph" \
  --arg limit=5
```

Calls a specific operation the connector supports. Every provider exposes different operations — see the connector's docs (or `connectors get` for the list).

Flags:

* `<id>` — connector.
* `<operation>` — operation name (e.g. `search`, `list_channels`).
* `--arg KEY=VALUE` — one arg per flag, or:
* `--json <json>` — full args as JSON.

Common uses:

* Smoke-test that a rotated key works: `nora connectors invoke c_tavily search --arg query=test`.
* Ad-hoc data pull without wiring into a Flow.

## Recipes

### Rotate credentials in a script

```bash theme={null}
# Read new key from a file securely
cat new-key.txt | nora connectors update c_tavily --rotate-api-key -
```

Old key stays valid for 60 minutes to allow zero-downtime rotation.

### Verify all connectors still work

```bash theme={null}
for c in $(nora connectors list --json | jq -r '.[].id'); do
  echo "Testing $c..."
  nora connectors invoke $c ping 2>&1 | grep -q "ok" && echo "  OK" || echo "  FAIL"
done
```

(Operations vary by provider — `ping` is illustrative; check what each provider supports.)

### Migrate a connector to another workspace

```bash theme={null}
# Read from source
key=$(cat ~/.nora-keys/tavily)

# Create in destination
nora --workspace destination connectors create \
  --provider tavily \
  --name "Tavily" \
  --api-key "$key"
```

## Connectors vs. secrets

* **Connectors** are typed integrations for specific systems (Tavily, Brave, ...). The connector knows the API shape.
* **Secrets** are opaque string values (used in Tool headers, Trigger auth, DB URLs). No typed shape.

For a generic HTTP integration, use a Tool with a `secrets://` header. For a well-known provider (search, embeddings, etc.), use a Connector.

Both are workspace-scoped and encrypted at rest.

## Referencing a connector

From a Tool that needs a connector's key:

```bash theme={null}
nora tools headers add t_search \
  --name Authorization \
  --value "secrets://connector:c_tavily/api_key"
```

The tool interpolates the key at call time — never at edit time.

## Access

Any workspace member can list connectors and see names. Only Managers and Owners can create, rotate, or delete. The actual key value is never returned to any user through the CLI or app.

## Deletion audit

Every deletion is logged (see [Audit trail](/reliable/versions/audit)). If a connector was accidentally deleted, the referenced Tools/pipelines that broke are the fastest way to detect it — they'll error on next run with "connector not found".