Skip to main content
A Provider Plugin can offer several authentication strategies. A Workspace chooses one strategy for each Provider connection and supplies the fields in that strategy’s configSchema. Common choices include an API key, bearer token, OAuth application, service account, or machine-to-machine credential. The available choices come from the Provider Plugin rather than from a global list exposed to the caller.

​
Inspect a strategy

An entry in supportedAuthStrategies provides:

​
Handle secrets

Supply secrets only through authenticationConfig. Secret fields are stored outside ordinary API records and are not returned later. Responses may include safe, non-secret configuration or masked values, but callers must retain the original secret if they need it elsewhere.

​
Validate and refresh credentials

  • POST /api/connectors/validate checks credentials without saving a connection.
  • POST /api/connectors/configure replaces saved credentials or other connection configuration.
  • POST /api/connectors/connector-oauth-start begins a browser OAuth flow.
  • POST /api/connectors/connector-oauth-complete completes that flow.
  • GET /api/vendors/tenant-connector-credential-detail returns safe error detail for a connection in a credential-error state.
Provider-specific instructions for creating an OAuth application, selecting scopes, or generating an API key belong with that Provider’s setup guide. The protocol reference describes only the values exchanged with Parable.