Connectors

Reusable, credentialed connections to external systems.

A Connector is a saved credential for an external service. Configure one at the workspace level; any Flow or Foundry pipeline can reference it by name without re-authing.

Supported services

Service	Modes
Google Drive	Read files & folders, watch for changes
Google Workspace (Docs, Sheets, Gmail, Calendar)	Read documents, list events, watch inbox
Microsoft 365 (OneDrive, SharePoint, Outlook)	Read files, watch for changes
Notion	Read pages & databases, watch
Slack	Read channels, watch messages, post messages
Confluence	Read spaces, watch page updates
GitHub	Read repos, PRs, issues; watch pushes
S3-compatible (AWS S3, R2, GCS)	Read objects, watch bucket prefix
Postgres / MySQL / SQL Server	Query and stream tables
HTTP (generic)	Custom REST endpoints with any auth

New connectors ship regularly. The picker in the app shows the current set.

Creating a connector

Settings → Connections → New:

1. Pick the service.
2. Auth via OAuth (most services) or paste credentials directly (databases, S3, generic HTTP).
3. Give it a memorable name.
4. Optionally scope it (specific folder, bucket, channel) — narrower scopes reduce accidental exposure.

Save. Credentials are encrypted at rest and never returned via the UI or API.

From the CLI

nora connectors create --provider tavily --name "Tavily search" --api-key ?

Full CLI docs: nora connectors.

Using a connector

In any block that consumes the service (Source block in a pipeline, Tool block in a Flow), pick the connector from the dropdown. The block surfaces service-specific config (which folder, which channel, which SQL) but the credentials come from the connector.

Testing

Every connector has a Test button (or nora connectors invoke <id> ping from CLI). Runs a read-only probe (list a folder, count messages in a channel, SELECT 1). Green means credentials are valid.

Rotating credentials

Settings → Connections → [connector] → Rotate. Or:

nora connectors update c_tavily --rotate-api-key ?

Old credentials keep working for a 60-minute grace period so in-flight pipelines don’t fail.

Rotate on a schedule (quarterly is common) or immediately after suspected leak.

Least privilege

Recommended:

• OAuth connectors default to the narrowest scope that supports read-only access.
• For databases, create a Nora-only user with SELECT on specific schemas.
• For S3, use an IAM policy scoped to a single prefix.
• For webhooks, use per-endpoint tokens rather than a workspace-wide bearer.

Broad-scope credentials are easier at setup but leave larger blast radius if leaked.

Deletion

Deleting fails if any Flow or Pipeline still references the connector. The error names the blockers so you know what to update first.

Deletion is audited (see Audit trail).

Custom auth

For services not in the picker, use the HTTP (generic) connector. Supports:

• API key (X-API-Key or custom header).
• Bearer token.
• Basic auth.
• OAuth 2.0 client credentials.
• Signed requests via a small pre-request script (advanced).

Combines with per-Tool headers to cover essentially any HTTP-based service.

Connector vs. Tool: which surface?

• Connector — reusable credentials, especially when many Flows share the same service.
• Tool block — inline; the credential lives on the Tool. Fine for one-off integrations wired directly into one Flow.

Rule of thumb: if two Flows will use the same credential, make it a Connector. If it’s one Flow only, a Tool block is simpler.

Related

• nora connectors — full CLI reference.
• Foundry Connectors — how pipelines consume connectors.
• Google Workspace walkthrough — focused setup for the most common connector.
• MCP — for coding agents driving Nora.