Connection
Which external account a reviewed action runs as — and where its credential lives.
A connection is one account at an external provider: a particular Shopify store, a production versus sandbox CRM, one customer’s workspace at a vendor. Use one connection per external account so there is never ambiguity about which one an action used.
Where the credential actually goes
Put the secret in AWS Secrets Manager or your equivalent vault, then give FlozentAi its reference. The authentication method you pick on the connection form describes what the executor will find behind that reference — it is not a request for you to type the credential in.
| Method | What the vault entry holds |
|---|---|
| OAuth 2.0 / OIDC | The access and refresh tokens the provider issued |
| API key | The API key string |
| Personal access token | A token a person generated in the provider |
| Service account | The key file or JSON the provider issued |
| Username and password | Both values, stored together under one reference |
OAuth without a vault step
For a provider registered in the deployment’s OAuth configuration, FlozentAi can obtain the credential itself: it sends the operator to the provider, exchanges the authorization code with PKCE, stores the result under a generated reference, and activates the connection. The exchange succeeding is itself the verification.
POST /v1/management/organizations/{organizationId}
/applications/{applicationId}
/environments/{environmentId}
/connections/oauth/{provider}/begin
{ "name": "Shopify production", "externalAccountRef": "store-a", "scopes": ["orders.read"] }Lifecycle
Suspend or revoke a connection when access changes. Pending tool executions using it are rejected at request, approval and dispatch — all three checks, not just the first.