Open Connector
Create Connector API credentials

Create Connector API credentials

Create an organization service account, restrict connection and integration access, and rotate its API key.

Use a dedicated Connector service account for each integration worker. Assign explicit connections, integration IDs, and scopes so you can revoke one worker without removing unrelated product connections.

Before you begin

You need the following access and deployment state:

  • You have the Connector Administrator role in the selected organization.
  • The connection or custom integration exists, and you know its ID.
  • Your integration host can reach the API endpoint over trusted HTTPS and can load secrets from its secret manager.

Create a service account and key

  1. In Console, open Organization → Connector → Access → Service accounts. Select Create account and enter its name and responsible team.
  2. In Account → Access, assign Integration Developer for the custom integration, or Connector Viewer for a worker that only reads context. Select the allowed connection and integration IDs.
  3. In Account → Keys, select Create key. Choose an expiry accepted by the organization policy and the scopes required for the worker.
  4. Save the one-time key in the integration host's secret manager. Record its key ID separately; later key reads do not reveal its plaintext.
  5. From the integration host, perform the first catalog read. Confirm that the returned connection and resource IDs match the assigned scope.

If the key response is lost, in Account → Keys, revoke that key and create a replacement. A browser session or an enrollment identity cannot replace the key.

Select scopes by task

The following scope sets keep operational tasks separate:

WorkerScopes
Catalog readerconnections:read, resources:read, mappings:read
External record publisherintegrations:read, resources:read, records:write
Mapping managerresources:read, mappings:read, mappings:write
Webhook administratorsubscriptions:read, subscriptions:write, operations:read
Delivery recoverydeliveries:read, deliveries:write, events:read, operations:read
Connection administratorconnections:read, connections:write, grants:read, grants:write, sync:write, operations:read

Grant decisions also require grants:approve and administrator authority over the endpoint being approved. Giving a worker that scope does not confer Infra or Guard product administration. Product mutations need their native credentials and permission checks.

Rotate a worker key

  1. In Account → Keys, select Create key with the same bounded scope.
  2. In the integration host's secret manager, deploy the replacement key.
  3. From the worker, complete its normal read or publish request. Confirm the resulting request ID in Connector → Activity and the expected resource scope.
  4. In Account → Keys, select the previous key and select Revoke. Confirm Revoked and another successful request using the replacement.

If the worker returns 401, inspect key audience, expiry, and revocation. If it returns 403, inspect the account's role, bindings, scopes, and active grant. Revocation prevents subsequent authorization; inspect accepted operations separately.