> ## Documentation Index
> Fetch the complete documentation index at: https://docs.parable.work/llms.txt
> Use this file to discover all available pages before exploring further.

# Provider Authentication

> Choose an authentication strategy, supply its configuration, and validate Provider credentials safely.

A Provider Plugin can offer several **authentication strategies**. A Workspace
chooses one strategy for each Provider connection and supplies the fields in
that strategy's `configSchema`.

Common choices include an API key, bearer token, OAuth application, service
account, or machine-to-machine credential. The available choices come from the
Provider Plugin rather than from a global list exposed to the caller.

## Inspect a strategy

An entry in `supportedAuthStrategies` provides:

| Field                | Use                                                             |
| -------------------- | --------------------------------------------------------------- |
| `id`                 | Stable value sent as `authenticationStrategyId`.                |
| `type`               | Technical authentication mechanism.                             |
| `label`              | Reader-facing name for setup.                                   |
| `configSchema`       | Required configuration fields and their secret annotations.     |
| `docs`               | Optional Provider-specific setup guidance.                      |
| Method configuration | Instructions for how Parable sends or exchanges the credential. |

## Handle secrets

Supply secrets only through `authenticationConfig`. Secret fields are stored
outside ordinary API records and are not returned later. Responses may include
safe, non-secret configuration or masked values, but callers must retain the
original secret if they need it elsewhere.

## Validate and refresh credentials

* `POST /api/connectors/validate` checks credentials without saving a
  connection.
* `POST /api/connectors/configure` replaces saved credentials or other
  connection configuration.
* `POST /api/connectors/connector-oauth-start` begins a browser OAuth flow.
* `POST /api/connectors/connector-oauth-complete` completes that flow.
* `GET /api/vendors/tenant-connector-credential-detail` returns safe error
  detail for a connection in a credential-error state.

Provider-specific instructions for creating an OAuth application, selecting
scopes, or generating an API key belong with that Provider's setup guide. The
protocol reference describes only the values exchanged with Parable.