Connections · Help

If a flow needs to ask your own system for a customer's order status, the panel has to know how to reach that system. Portfolio settings › Connections is where you record that once: the address, the credentials and the default headers. In the flow step you then pick only the connection and the path; no key is written into the flow. This guide covers every field on the screen.

⚠️ Owner and Admin can open this screen, and it only appears in the menu if integrations is enabled on your plan. The screen carries secret values; on a plan without it, knowing the address won't get you in.

What it is for

The info box at the top defines the job: "A connection is an address and a credential for an outbound request step to use. In the step you pick only the connection and the path; no key is written into the flow."

That separation has two benefits:

Secrecy. Your API key does not sit inside the flow. Someone who can see the flow (a team member with the editor role) doesn't see the key.
One place to change it. If your key changes, you don't have to fix twenty flows one by one; you update the connection once.

The second info line lists the safeguards: "Addresses are called with internal-network protection and a timeout; secret values are stored encrypted and are only sent to the connection's own address." So the panel checks that the address you typed doesn't point at an internal network, doesn't wait forever, and never sends your secret anywhere else.

How to reach the screen

Open the account switcher at the top left.
Click the gear icon next to the portfolio name.
Pick Connections from the menu.

The connections list

Lists your saved connections. Each row shows its name, base URL, scope and status badge (Active / Off), with Edit, Test and Delete connection buttons beside it.

With none saved, the list reads "No connections yet."

Test

The Test button really tries the connection. Press it and it briefly says "Testing…", then reports one of three results:

Connected — the address responded.
Could not connect — the address didn't respond or returned an error.
Timed out — the address took too long.

Under the result it also says whether credentials were sent: "Credentials were sent." or "No authentication: the request went out without credentials." That second line is how you catch having accidentally left authentication on None.

Deleting a connection

The confirmation states the consequence: "Delete …? Steps using this connection will not run."

This differs from AI keys: a key has a fallback, a connection does not. Outbound request steps using a deleted connection simply do not run. Know which flows use it before you delete.

The add-connection form

The section below the list, titled Add connection or, while editing, Edit connection.

Name

This is the name the step picks it by. Keep it clear: "Order system", "Stock API", "CRM". Only this name shows in the step box; the address does not.

Base URL

The service's root address, and it starts with https://. The path you type in the step is appended to it.

A concrete example: with a base URL of https://api.myshop.com/v1, you type /order/12345 as the path in the step and the call goes to https://api.myshop.com/v1/order/12345. Splitting the base URL correctly is what lets you reuse one connection with many different paths.

Authentication

The list where you pick what kind of credential the service expects. Which one is stated in the service's own documentation. There are five options, each opening different fields.

None. No credentials are sent. Enough for a public endpoint.

Username and password. Opens two fields: Username and Password. The panel sends them in the standard basic authentication header.

Bearer token. Opens a single Key field. The most common method; the panel sends the key in an Authorization: Bearer … header.

API key in a header. Opens three fields:

Key — the secret value.
Header name — which header the key goes in. Leave it blank and Authorization is used.
Value prefix — text to put in front of the key, if any. Some services expect a prefix such as Token or ApiKey .

Token fetched from a token URL. The most involved method: the panel first calls an address to obtain a temporary key, then makes the request with it. Its fields:

Token URL — the https address to fetch the key from.
Client ID and Client secret — the credential pair the service gave you.
How to send the credentials — two options: In the request body or In a username-and-password header. Pick whichever the service's documentation specifies.
Extra fields — additional fields to send to the token URL (up to 10). Some services expect fields such as scope or grant_type.
Path to the key — which field of the response holds the key. Leave it blank and access_token is used.
Path to the expiry — the field giving validity in seconds. Leave it blank and expires_in is used.

Every secret field follows the same rule: stored encrypted, never shown again. Leave it blank while editing and the saved value is kept.

Default headers

A list of headers to send on every request; you can add up to 10 rows. Each row takes a name and a value; to drop a row, tap Delete row next to it.

This is usually where Accept: application/json or a version header the service wants goes. There is one rule in the hint: the authentication header does not go here. Use the authentication section above for credentials; mixing the two sends the header twice and the service rejects it.

Accounts to use it on

Exactly the same logic as AI keys:

All accounts — every account in the portfolio uses this connection.
Selected accounts — only the accounts you tap to select. Select none and the list reads "No account selected" and the connection is used nowhere.

Use this connection

A checkbox that decides whether the connection is Active or Off. Turning it off is safer than deleting: the connection stays saved, steps won't find it, but it isn't gone.

Saving

Press Add connection for a new one, or Save while editing.

A suggested setup order

Open the service's documentation and find two things: the root address and the authentication method.
Add the connection with those two, and set the scope to Selected accounts with a single account ticked.
Run Test. Keep fixing the form until you see "Connected" and "Credentials were sent."
Build an outbound request step in a flow and try it with a real path.
Once you're sure it works, change the scope to All accounts.

Common mistakes

Putting the authentication header in the "Default headers" list. There is a separate section for credentials; doing both breaks the request.

Including the path in the base URL. Write https://api.example.com/v1/order and then /order in the step, and the address takes the path twice.

Using an http:// address. The address must start with https.

Trying to read the key back after saving. It is never shown again.

Going live without testing. The Test button costs you a minute and saves hours of hunting.

Deleting a connection without checking your flows. Steps using a deleted connection won't run; unlike AI keys, there is no fallback.

Setting the scope to "Selected accounts" and ticking none. The connection is used nowhere.

For how an outbound request step is built, see the Flow steps section. For what happens to connections when an account moves see Moving an account to another portfolio, and for the same scope logic on AI keys see AI keys.