Connectors

Reusable, credentialed connections to the outside world.

A Connector is a saved credential for an external system. Once you set one up, any pipeline in the workspace can use it — no re-authing per pipeline.

Available connectors

System	Modes
Google Drive	Read files & folders, watch for changes
Google Workspace (Docs, Sheets, Gmail, Calendar)	Read documents, list events, watch inbox
Microsoft 365 (OneDrive, SharePoint, Outlook)	Read files, watch for changes
Notion	Read pages & databases, watch
Slack	Read channels, watch messages, post messages
Confluence	Read spaces, watch page updates
GitHub	Read repos, PRs, issues; watch pushes
S3-compatible (AWS S3, R2, GCS)	Read objects, watch bucket prefix
Postgres / MySQL / SQL Server	Query and stream tables
HTTP (generic)	Custom REST endpoints with any auth

More are added regularly — check the connector picker in the app for the current set.

Creating a connector

1. Settings → Connectors → New.
2. Pick the system.
3. Auth via OAuth (most systems) or paste credentials directly (databases, S3, generic HTTP).
4. Give it a memorable name.
5. Optionally scope it to specific folders, buckets, or channels — narrower scopes reduce accidental exposure.

Once saved, credentials are encrypted at rest. The UI never shows the raw value again.

Using a connector

In any Source block, pick the connector from the dropdown. The block will surface config specific to that system (which folder, which channel, which SQL, etc).

Testing

Every Connector has a Test button that runs a read-only probe (list a folder, count messages in a channel, run SELECT 1). Green means credentials are valid.

Rotating credentials

Settings → Connectors → [name] → Rotate. Old credentials keep working for a 60-minute grace period so in-flight pipelines don’t fail.

Least privilege

• OAuth connectors default to the narrowest scope that satisfies read-only access.
• For databases, create a Nora-only user with SELECT on specific schemas.
• For S3, use an IAM policy scoped to a single prefix.

Deletion

Deleting a connector fails if any pipeline still references it. Update the pipelines first, then delete.

Custom auth

For systems not listed, use the HTTP (generic) connector. It supports API key, bearer, basic, and OAuth 2.0 client-credentials. You can also inject signed headers via a small pre-request script.