[{"data":1,"prerenderedAt":321},["ShallowReactive",2],{"docs:navigation":3,"docs:page:\u002Fdocs\u002Fconnect\u002Fcredentials":115},[4],{"title":5,"path":6,"stem":7,"children":8,"icon":10},"Introduction","\u002Fdocs","docs\u002F1.index",[9,11,16,21,38,95,110],{"title":5,"path":6,"stem":7,"icon":10},"i-lucide-house",{"title":12,"path":13,"stem":14,"icon":15},"Quickstart","\u002Fdocs\u002Fquickstart","docs\u002F2.quickstart","i-lucide-rocket",{"title":17,"path":18,"stem":19,"icon":20},"Essentials","\u002Fdocs\u002Fconfiguration","docs\u002F3.configuration","i-lucide-book-open",{"title":22,"path":23,"stem":24,"children":25,"icon":27},"Authentication","\u002Fdocs\u002Fauthentication","docs\u002F4.authentication\u002Findex",[26,28,33],{"title":22,"path":23,"stem":24,"icon":27},"i-lucide-shield-check",{"title":29,"path":30,"stem":31,"icon":32},"Protect User Data","\u002Fdocs\u002Fauthentication\u002Fuser-data","docs\u002F4.authentication\u002F1.user-data","i-lucide-user-lock",{"title":34,"path":35,"stem":36,"icon":37},"Two-Factor Verification","\u002Fdocs\u002Fauthentication\u002Ftwo-factor","docs\u002F4.authentication\u002F2.two-factor","i-lucide-key-round",{"title":39,"path":40,"stem":41,"children":42,"icon":44},"Deployment","\u002Fdocs\u002Fdeployment","docs\u002F5.deployment\u002Findex",[43,45,50,55,60,65,70,75,80,85,90],{"title":39,"path":40,"stem":41,"icon":44},"i-lucide-cloud-upload",{"title":46,"path":47,"stem":48,"icon":49},"Deploy to Cloudflare","\u002Fdocs\u002Fdeployment\u002Fcloudflare","docs\u002F5.deployment\u002F1.cloudflare","i-simple-icons-cloudflare",{"title":51,"path":52,"stem":53,"icon":54},"Platform Support","\u002Fdocs\u002Fdeployment\u002Fsupport","docs\u002F5.deployment\u002F10.support","i-lucide-list-checks",{"title":56,"path":57,"stem":58,"icon":59},"Deploy to Vercel","\u002Fdocs\u002Fdeployment\u002Fvercel","docs\u002F5.deployment\u002F2.vercel","i-simple-icons-vercel",{"title":61,"path":62,"stem":63,"icon":64},"Deploy to Azure","\u002Fdocs\u002Fdeployment\u002Fazure","docs\u002F5.deployment\u002F3.azure","i-simple-icons-microsoftazure",{"title":66,"path":67,"stem":68,"icon":69},"Switch Hosts","\u002Fdocs\u002Fdeployment\u002Fswitch-hosts","docs\u002F5.deployment\u002F4.switch-hosts","i-lucide-arrow-right-left",{"title":71,"path":72,"stem":73,"icon":74},"Database and File Storage","\u002Fdocs\u002Fdeployment\u002Fdata-services","docs\u002F5.deployment\u002F5.data-services","i-lucide-database",{"title":76,"path":77,"stem":78,"icon":79},"Domains and Secrets","\u002Fdocs\u002Fdeployment\u002Fsettings","docs\u002F5.deployment\u002F6.settings","i-lucide-settings",{"title":81,"path":82,"stem":83,"icon":84},"Troubleshoot Deployment","\u002Fdocs\u002Fdeployment\u002Ftroubleshooting","docs\u002F5.deployment\u002F7.troubleshooting","i-lucide-wrench",{"title":86,"path":87,"stem":88,"icon":89},"Deploy Agents","\u002Fdocs\u002Fdeployment\u002Fagents","docs\u002F5.deployment\u002F8.agents","i-lucide-bot",{"title":91,"path":92,"stem":93,"icon":94},"Deploy Automations","\u002Fdocs\u002Fdeployment\u002Fautomations","docs\u002F5.deployment\u002F9.automations","i-lucide-workflow",{"title":96,"path":97,"stem":98,"children":99,"icon":101},"Connect Accounts","\u002Fdocs\u002Fconnect","docs\u002F6.connect\u002Findex",[100,102,106],{"title":96,"path":97,"stem":98,"icon":101},"i-lucide-plug",{"title":103,"path":104,"stem":105,"icon":37},"Connection Credentials","\u002Fdocs\u002Fconnect\u002Fcredentials","docs\u002F6.connect\u002F1.credentials",{"title":107,"path":108,"stem":109,"icon":84},"Connect MCP Servers","\u002Fdocs\u002Fconnect\u002Fmcp","docs\u002F6.connect\u002F2.mcp",{"title":111,"path":112,"stem":113,"icon":114},"Project Reference","\u002Fdocs\u002Freference","docs\u002F7.reference","i-lucide-terminal",{"page":116,"surround":316},{"id":117,"title":103,"body":118,"description":309,"extension":310,"links":311,"meta":312,"navigation":313,"path":104,"seo":314,"stem":105,"__hash__":315},"docs\u002Fdocs\u002F6.connect\u002F1.credentials.md",{"type":119,"value":120,"toc":301},"minimark",[121,129,134,137,164,167,171,188,205,216,220,230,241,244,248,262,292],[122,123,124,125,128],"p",{},"Use this reference when setting up an integration or deploying an app that\nalready uses Connect. For a complete first connection, follow\n",[126,127,96],"a",{"href":97},".",[130,131,133],"h2",{"id":132},"know-which-secret-does-what","Know Which Secret Does What",[122,135,136],{},"Connect manages the credentials obtained when someone connects an account. You\nstill register an OAuth app with each vendor whose direct OAuth integration you\noffer:",[138,139,140,148,154],"ul",{},[141,142,143,147],"li",{},[144,145,146],"strong",{},"Client ID and client secret:"," identify your application to the vendor. You\nobtain them in the vendor console, and Connect reads them from your server\nenvironment.",[141,149,150,153],{},[144,151,152],{},"Access and refresh tokens:"," authorize a particular connected account. Connect\nobtains them after consent and encrypts them in your database.",[141,155,156,163],{},[144,157,158,162],{},[159,160,161],"code",{},"CLOUDCONFIG_CONNECT_KEY",":"," encrypts those stored account credentials. The CLI\ngenerates it, and it stays outside the database.",[122,165,166],{},"CloudConfig runs the connection infrastructure in your app. It does not supply a\nshared OAuth app or create vendor apps for you. You own app registration,\nconsent-screen settings, enabled vendor APIs, and any required vendor review.\nUsers authorize their accounts through your registered app; they do not need to\nsupply its client secret.",[130,168,170],{"id":169},"keep-sign-in-and-integrations-separate","Keep Sign-In and Integrations Separate",[122,172,173,176,177,180,181,184,185,128],{},[159,174,175],{},"auth.providers.google"," lets someone sign in to your app. It defaults to\n",[159,178,179],{},"GOOGLE_CLIENT_ID",", ",[159,182,183],{},"GOOGLE_CLIENT_SECRET",", and ",[159,186,187],{},"\u002Fapi\u002Fauth\u002Fcallback\u002Fgoogle",[122,189,190,193,194,180,197,200,201,204],{},[159,191,192],{},"connect.providers.google"," lets an agent or job act through a Google account. It\ndefaults to ",[159,195,196],{},"CONNECT_GOOGLE_CLIENT_ID",[159,198,199],{},"CONNECT_GOOGLE_CLIENT_SECRET",", and\n",[159,202,203],{},"\u002Fapi\u002Fconnect\u002Fgoogle\u002Fcallback",". The connected account can differ from the sign-in\naccount, and Google sign-in does not need to be enabled.",[122,206,207,208,211,212,215],{},"Setting up one does not configure the other. GitHub also uses different app\ntypes: ",[159,209,210],{},"cloudconfig auth add github"," guides GitHub OAuth App setup for sign-in;\n",[159,213,214],{},"cloudconfig connect add github"," guides GitHub App setup for integrations.",[130,217,219],{"id":218},"set-up-without-prompts","Set Up Without Prompts",[122,221,222,225,226,229],{},[159,223,224],{},"cloudconfig connect add google"," enables the provider when the CLI can safely\nedit your config. Without an interactive terminal, or with ",[159,227,228],{},"--no-prompt",", it\nprints instructions instead of collecting vendor credentials.",[122,231,232,233,236,237,240],{},"Supply the printed variables yourself through ",[159,234,235],{},".env"," or the process\nenvironment. The command can still enable the provider and generate the\nsealing key. ",[159,238,239],{},".env.example"," is a placeholder template, not a credentials file.",[122,242,243],{},"A provider without its required credentials is unavailable for OAuth. An API-key\nfallback, if offered, belongs to your application's integration flow.",[130,245,247],{"id":246},"deploy-and-maintain-connections","Deploy and Maintain Connections",[122,249,250,253,254,257,258,261],{},[126,251,252],{"href":40},"Deploy"," with ",[159,255,256],{},"cloudconfig deploy",". It derives Connect's secret\nnames from the config, requires the sealing key, and uploads provider app\ncredentials when supplied. You do not need to repeat these names in\n",[159,259,260],{},"deploy.secrets",". Missing provider credentials can leave that provider unavailable\nwithout blocking the rest of the deployment.",[122,263,264,265,268,269,272,273,276,277,280,281,284,285,288,289,291],{},"Keep the sealing key across deployments. Nuxt projects with ",[159,266,267],{},"deploy.automations","\nrun bounded housekeeping every five minutes, preserving a sweep cursor between\njobs. It refreshes expiring tokens, re-seals connections and registered MCP client\nsecrets after key rotation, and removes abandoned connections. Tune\n",[159,270,271],{},"connect.maintenance: { cron, timeZone, limit }"," (1–500 rows per table per run), or\nset it to ",[159,274,275],{},"false"," when another scheduler owns housekeeping. Without an automation\nhost, schedule ",[159,278,279],{},"connect.maintain()"," yourself. Retain older keys until a full sweep\nfinishes successfully and inspect failed-row counts before removing them.\nDisconnecting removes a\nconnection and attempts vendor revocation where supported. Connect verifies\nsupported vendor webhooks before handing events to your application. Configure\n",[159,282,283],{},"connect.webhooks: { task: 'provider-event' }"," with an automation host for durable\nhandoff, retry deduplication, and processing after the accepting request ends.\nExisting ",[159,286,287],{},"onConnectWebhook"," handlers still execute inline; keep them short.\nSee ",[126,290,91],{"href":92}," for setup and scope checks.",[122,293,294,295,297,298,300],{},"Use ",[159,296,239],{}," to record names, not values. Keep ",[159,299,161],{},"\noutside the database and preserve it across host changes so existing tokens\nremain decryptable.",{"title":302,"searchDepth":303,"depth":303,"links":304},"",2,[305,306,307,308],{"id":132,"depth":303,"text":133},{"id":169,"depth":303,"text":170},{"id":218,"depth":303,"text":219},{"id":246,"depth":303,"text":247},"Distinguish vendor app secrets from account tokens, then keep connections working in production.","md",null,{},{"icon":37},{"title":103,"description":309},"Y-nUeTfqfJtqM0n-Hv0khORX584iufOI44cmkzePF2k",[317,319],{"title":96,"path":97,"stem":98,"description":318,"icon":101},"Let signed-in users authorize a Google account for your server to use.",{"title":107,"path":108,"stem":109,"description":320,"icon":84},"Authorize hosted MCP tools or reuse a provider account you already connected.",1792122403646]