Skip to main content
A Connector is a saved credential for an external service. Configure one at the workspace level; any Flow or Foundry pipeline can reference it by name without re-authing.

​
Supported services

New connectors ship regularly. The picker in the app shows the current set.

​
Creating a connector

Settings → Connections → New:
  1. Pick the service.
  2. Auth via OAuth (most services) or paste credentials directly (databases, S3, generic HTTP).
  3. Give it a memorable name.
  4. Optionally scope it (specific folder, bucket, channel) — narrower scopes reduce accidental exposure.
Save. Credentials are encrypted at rest and never returned via the UI or API.

​
From the CLI

Full CLI docs: nora connectors.

​
Using a connector

In any block that consumes the service (Source block in a pipeline, Tool block in a Flow), pick the connector from the dropdown. The block surfaces service-specific config (which folder, which channel, which SQL) but the credentials come from the connector.

​
Testing

Every connector has a Test button (or nora connectors invoke <id> ping from CLI). Runs a read-only probe (list a folder, count messages in a channel, SELECT 1). Green means credentials are valid.

​
Rotating credentials

Settings → Connections → [connector] → Rotate. Or:
Old credentials keep working for a 60-minute grace period so in-flight pipelines don’t fail. Rotate on a schedule (quarterly is common) or immediately after suspected leak.

​
Least privilege

Recommended:
  • OAuth connectors default to the narrowest scope that supports read-only access.
  • For databases, create a Nora-only user with SELECT on specific schemas.
  • For S3, use an IAM policy scoped to a single prefix.
  • For webhooks, use per-endpoint tokens rather than a workspace-wide bearer.
Broad-scope credentials are easier at setup but leave larger blast radius if leaked.

​
Deletion

Deleting fails if any Flow or Pipeline still references the connector. The error names the blockers so you know what to update first. Deletion is audited (see Audit trail).

​
Custom auth

For services not in the picker, use the HTTP (generic) connector. Supports:
  • API key (X-API-Key or custom header).
  • Bearer token.
  • Basic auth.
  • OAuth 2.0 client credentials.
  • Signed requests via a small pre-request script (advanced).
Combines with per-Tool headers to cover essentially any HTTP-based service.

​
Connector vs. Tool: which surface?

  • Connector — reusable credentials, especially when many Flows share the same service.
  • Tool block — inline; the credential lives on the Tool. Fine for one-off integrations wired directly into one Flow.
Rule of thumb: if two Flows will use the same credential, make it a Connector. If it’s one Flow only, a Tool block is simpler.