Connect methods
Five ways a credential or a grant reaches penv, and how the console learns that it landed.
Before penv can move a value it needs a way in. Each provider declares which kind it uses, and its page lists the exact methods the wizard offers.
The two kinds of credential
A credential you paste. A token or a key pair you already hold. penv seals it and never shows it again. Most providers work this way, and their page lists the fields the form asks for.
A grant you make. You give penv a role inside your own account, and penv holds no long-lived key of yours at all. The AWS role providers and the two GitHub App providers work this way. What penv seals is an id or a shared value the grant is conditioned on. It is never a secret of yours.
The Rotate button is hidden wherever there is nothing of yours to replace: a grant whose shared value penv generates, and a grant that seals no credential field at all.
The five methods
A grant offers one or more of these. The wizard pre-selects the recommended one, and the rest stay available.
| Method | What you do |
|---|---|
quick-link | Follow a prepared link into the vendor's console |
consent-redirect | Sign in at the vendor and consent |
iac-snippet | Apply a rendered policy or template |
cli-snippet | Run a rendered command |
manual | Paste a credential you already hold |
Every artifact a method renders is built from what you typed plus your workspace's own identifiers. A method that shows you a policy shows the one scoped to the settings in front of you, with write permissions only when the mapping you are about to make exports.
How the console learns it landed
| Completion | What happens |
|---|---|
callback | The vendor calls penv back. Leave the tab open and it flips on its own |
paste | You copy a value the vendor printed and paste it back |
poll | penv asks the vendor until the grant appears |
A method may also carry inputs it collects first, outputs it renders for you to copy, and steps in the order to do them. Each provider page lists all three.
Testing before anything is stored
The wizard can test a credential without storing it. Nothing reaches the database on that path. Verifying a connection that already exists is the audited one, because there is a stored credential whose state just changed.
Next: integrations in the console.