Connections

Creating a connection

When you add an action for an app that needs authentication, you are prompted to select an existing connection or create a new one. Depending on the app, you will authenticate with one of these methods:

• OAuth — sign in through the app’s consent screen; AgentFlow10 stores and refreshes the tokens for you.
• API key — paste a key that the app issues, sent as a header or query parameter.
• Bearer token — a token sent in the Authorization header.
• Basic auth — a username and password pair.

How credentials are secured

Connection secrets are encrypted at rest. They are only decrypted at run time inside the step that needs them, and are never exposed in flow definitions, logs, or run outputs.

If a connection ever fails to decrypt — for example after an encryption key change — the step reports a clear message instead of leaking any secret material, and you simply reconnect.

Reusing connections

A connection is created inside a project and can be used by any flow in that project. This means you connect an app such as Slack or Google once, then reference it from every flow without re-authenticating.

Global connections

On plans that support it, an admin can share a connection across multiple projects as a global connection. This is useful when one set of company credentials should power automations in several workspaces, while still being managed in a single place.

Rotating and revoking

• Update a connection’s credentials at any time; every flow that references it picks up the new secret on the next run.
• Delete a connection to immediately revoke access. Flows that depend on it will fail safely until you reconnect.

Troubleshooting

• 401 / unauthorized — the credential expired or was revoked in the source app. Reconnect the connection.
• Missing scopes — reconnect and grant the permissions the action requires during the OAuth consent step.