> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Connectors

> Reusable, credentialed connections to external systems.

A **Connector** is a saved credential for an external service. Configure one at the workspace level; any Flow or Foundry pipeline can reference it by name without re-authing.

## Supported services

| Service                                              | Modes                                        |
| ---------------------------------------------------- | -------------------------------------------- |
| **Google Drive**                                     | Read files & folders, watch for changes      |
| **Google Workspace** (Docs, Sheets, Gmail, Calendar) | Read documents, list events, watch inbox     |
| **Microsoft 365** (OneDrive, SharePoint, Outlook)    | Read files, watch for changes                |
| **Notion**                                           | Read pages & databases, watch                |
| **Slack**                                            | Read channels, watch messages, post messages |
| **Confluence**                                       | Read spaces, watch page updates              |
| **GitHub**                                           | Read repos, PRs, issues; watch pushes        |
| **S3-compatible** (AWS S3, R2, GCS)                  | Read objects, watch bucket prefix            |
| **Postgres / MySQL / SQL Server**                    | Query and stream tables                      |
| **HTTP (generic)**                                   | Custom REST endpoints with any auth          |

New connectors ship regularly. The picker in the app shows the current set.

## Creating a connector

**Settings → Connections → New**:

1. Pick the service.
2. Auth via OAuth (most services) or paste credentials directly (databases, S3, generic HTTP).
3. Give it a memorable name.
4. Optionally scope it (specific folder, bucket, channel) — narrower scopes reduce accidental exposure.

Save. Credentials are encrypted at rest and never returned via the UI or API.

### From the CLI

```bash theme={null}
nora connectors create --provider tavily --name "Tavily search" --api-key ?
```

Full CLI docs: [`nora connectors`](/cli/connectors).

## Using a connector

In any block that consumes the service (Source block in a pipeline, Tool block in a Flow), pick the connector from the dropdown. The block surfaces service-specific config (which folder, which channel, which SQL) but the credentials come from the connector.

## Testing

Every connector has a **Test** button (or `nora connectors invoke <id> ping` from CLI). Runs a read-only probe (list a folder, count messages in a channel, `SELECT 1`). Green means credentials are valid.

## Rotating credentials

**Settings → Connections → \[connector] → Rotate**. Or:

```bash theme={null}
nora connectors update c_tavily --rotate-api-key ?
```

Old credentials keep working for a 60-minute grace period so in-flight pipelines don't fail.

Rotate on a schedule (quarterly is common) or immediately after suspected leak.

## Least privilege

Recommended:

* OAuth connectors default to the narrowest scope that supports read-only access.
* For databases, create a Nora-only user with `SELECT` on specific schemas.
* For S3, use an IAM policy scoped to a single prefix.
* For webhooks, use per-endpoint tokens rather than a workspace-wide bearer.

Broad-scope credentials are easier at setup but leave larger blast radius if leaked.

## Deletion

Deleting fails if any Flow or Pipeline still references the connector. The error names the blockers so you know what to update first.

Deletion is audited (see [Audit trail](/reliable/versions/audit)).

## Custom auth

For services not in the picker, use the **HTTP (generic)** connector. Supports:

* API key (`X-API-Key` or custom header).
* Bearer token.
* Basic auth.
* OAuth 2.0 client credentials.
* Signed requests via a small pre-request script (advanced).

Combines with per-Tool headers to cover essentially any HTTP-based service.

## Connector vs. Tool: which surface?

* **Connector** — reusable credentials, especially when many Flows share the same service.
* **Tool block** — inline; the credential lives on the Tool. Fine for one-off integrations wired directly into one Flow.

Rule of thumb: if two Flows will use the same credential, make it a Connector. If it's one Flow only, a Tool block is simpler.

## Related

* [`nora connectors`](/cli/connectors) — full CLI reference.
* [Foundry Connectors](/build/foundry/connectors) — how pipelines consume connectors.
* [Google Workspace walkthrough](/settings/connections/google-workspace) — focused setup for the most common connector.
* [MCP](/settings/connections/mcp) — for coding agents driving Nora.