Setting up, by connection type

Providers are not uniformly “connected”. They arrive by four routes with genuinely different properties, and what you have to do differs in each.

Native OAuth

1. 1

   Start the connection in Hawi

   You are sent to the provider's own consent screen.

2. 2

   Authorise with an administrator account

   Some scopes cannot be granted by an ordinary member. Authorising with the wrong account is the second most common failure after a mismatched redirect URL.

3. 3

   Come back and wait for verification

   Authorisation and verification are separate. The connection is not usable until one harmless read has come back.

Encrypted credential

1. 1

   Generate the credential in the provider's own settings

   Usually a key pair or a token, with a permission level you choose there.

2. 2

   Paste it into the secure setup flow

   It is encrypted at rest and never displayed again. You will see a hint — enough to tell two apart — and never the value.

3. 3

   Verification runs the same way

   One harmless read. If it fails, the credential exists and does not have the access the connector needs.

Verified connector

A connector definition checked against the provider's API before it is offered. From your side it behaves like one of the two above; the difference is on Hawi's side, in what was confirmed before the option appeared.

External setup

Configured in the external system and pointed at Hawi, typically where a provider has no public authorisation flow. You hold the configuration; Hawi holds nothing it could revoke, which is worth knowing when you come to disconnect.