Connect methods
The two credential kinds, the five methods by which your credential or grant reaches us, and how our console confirms completion.
Each provider declares its credential kind; its page lists the methods the wizard offers.
Credential kinds
| Kind | What we seal | Providers |
|---|---|---|
| Pasted credential | Your token or key pair. We seal it and never show it again. | Most providers; the page lists the form fields. |
| Grant | An id or shared value the grant is conditioned on, never a secret of yours. We hold no long-lived key. | AWS role providers, the two GitHub App providers. |
We hide the Rotate button where you supplied nothing to replace: a grant whose shared value we generate, or a grant that seals no credential field.
Methods
A grant offers one or more methods. The wizard pre-selects the recommended one.
| Method | Action |
|---|---|
quick-link | Follow a prepared link into the vendor's console. |
consent-redirect | Sign in at the vendor and consent. |
iac-snippet | Apply a rendered policy or template. |
cli-snippet | Run a rendered command. |
manual | Paste an existing credential. |
We render artifacts from the settings you enter plus your workspace's identifiers. A rendered policy is scoped to those settings and includes write permissions only when the mapping exports.
Completion
| Completion | Behavior |
|---|---|
callback | The vendor calls us back; your open tab updates. |
paste | Copy the value the vendor printed and paste it back. |
poll | We poll the vendor until the grant appears. |
A method may also declare inputs collected first, outputs rendered to copy, and ordered steps. Each provider page lists all three.
Test without storing
The wizard can test a credential without storing it; nothing reaches our database. We audit verifying an existing connection, because a stored credential's state changes. Sync behavior: how syncs work.