> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Connectors

> Reusable, credentialed connections to the outside world.

A **Connector** is a saved credential for an external system. Once you set one up, any pipeline in the workspace can use it — no re-authing per pipeline.

## Available connectors

| System                                               | Modes                                        |
| ---------------------------------------------------- | -------------------------------------------- |
| **Google Drive**                                     | Read files & folders, watch for changes      |
| **Google Workspace** (Docs, Sheets, Gmail, Calendar) | Read documents, list events, watch inbox     |
| **Microsoft 365** (OneDrive, SharePoint, Outlook)    | Read files, watch for changes                |
| **Notion**                                           | Read pages & databases, watch                |
| **Slack**                                            | Read channels, watch messages, post messages |
| **Confluence**                                       | Read spaces, watch page updates              |
| **GitHub**                                           | Read repos, PRs, issues; watch pushes        |
| **S3-compatible** (AWS S3, R2, GCS)                  | Read objects, watch bucket prefix            |
| **Postgres / MySQL / SQL Server**                    | Query and stream tables                      |
| **HTTP (generic)**                                   | Custom REST endpoints with any auth          |

More are added regularly — check the connector picker in the app for the current set.

## Creating a connector

1. **Settings → Connectors → New**.
2. Pick the system.
3. Auth via OAuth (most systems) or paste credentials directly (databases, S3, generic HTTP).
4. Give it a memorable name.
5. Optionally scope it to specific folders, buckets, or channels — narrower scopes reduce accidental exposure.

Once saved, credentials are encrypted at rest. The UI never shows the raw value again.

## Using a connector

In any Source block, pick the connector from the dropdown. The block will surface config specific to that system (which folder, which channel, which SQL, etc).

## Testing

Every Connector has a **Test** button that runs a read-only probe (list a folder, count messages in a channel, run `SELECT 1`). Green means credentials are valid.

## Rotating credentials

**Settings → Connectors → \[name] → Rotate**. Old credentials keep working for a 60-minute grace period so in-flight pipelines don't fail.

## Least privilege

* OAuth connectors default to the narrowest scope that satisfies read-only access.
* For databases, create a Nora-only user with `SELECT` on specific schemas.
* For S3, use an IAM policy scoped to a single prefix.

## Deletion

Deleting a connector fails if any pipeline still references it. Update the pipelines first, then delete.

## Custom auth

For systems not listed, use the **HTTP (generic)** connector. It supports API key, bearer, basic, and OAuth 2.0 client-credentials. You can also inject signed headers via a small pre-request script.