> ## Documentation Index > Fetch the complete documentation index at: https://docs.corvic.ai/llms.txt > Use this file to discover all available pages before exploring further. # Connector Vault > Securely connect external APIs so your agents can call them from code. The **Connector Vault** (formerly the API Secret Vault) is where your organization stores the credentials and settings for everything Corvic connects to: external APIs, OAuth apps, MCP servers, cloud storage, and databases. Agents, workflows, apps, and playbooks use a connector by name. Corvic's proxy injects the secret into the request, so the credential never appears in agent code, logs, or chat history. This is what powers connectors used by [Room Templates](https://docs.corvic.ai/features/room-templates.md): when a template needs Crunchbase, PubMed, or Apify, those are Connector Vault connections. Find it under **Settings → Connector Vault**. ![Connector Vault tab showing connected API cards and the preset catalog](https://mintcdn.com/corvicinc/E09Qw1MOZESGbjrM/images/api-secret-vault.png?fit=max\&auto=format\&n=E09Qw1MOZESGbjrM\&q=85\&s=fb7cc70e91408b10f1331e8dd0cbe516) ### How it works When code makes an HTTP request to a connected API's origin — an agent's `execute_python` step, a workflow step, an app, or a playbook — Corvic's proxy automatically attaches the stored credential to the correct header (or query parameter). The code references the connection by name and never handles the raw secret. Connectors for MCP servers, cloud storage, and databases work the same way: the credential stays in the vault and Corvic presents it on the connection. ### Connector types | Type | Use it for | | - | - | | **API key** | Services that take a bearer token, API key, basic authentication, or a query parameter | | **OAuth** | Services you sign in to; Corvic keeps the access token refreshed | | **MCP** | MCP servers, including hosted ones such as Jira and Prior Labs, whose tools agents can call | | **Cloud storage** | Amazon S3 (and S3-compatible stores), Google Cloud Storage, and Azure Storage buckets and containers | | **Database** | Oracle databases, including change data capture | Snowflake and Databricks are available as presets in the catalog below. ## Connector catalog The catalog includes one-click presets for dozens of common services, grouped by category, and it grows with most releases. Each preset prefills the API origin and the correct authentication header so connecting is just "pick a service and paste your token." The categories below are listed in the page navigation for quick reference. > [!NOTE] > > Presets never carry a real secret: only the **shape** of the request (origin, header name, and an example value). Nothing sensitive ships in the product bundle; your credential is only stored when you enter it. ### Sales & CRM ### Finance SerpApi covers Google Finance, Patents, Search, and more. ### Healthcare ### Databases & Data ### Communication ### Productivity ### Developer ### Marketing ## Custom integration > [!TIP] > > Not in the catalog? Add a **custom** connection by entering any API origin, the header your service expects, and your credential. Anything reachable over HTTPS can be connected. ### API Key Use an API key, personal access token, or other static credential to connect a service. Select a catalog preset or add a custom HTTPS origin, then enter the value in the format the service expects. Corvic stores the value securely and injects it into requests from allowlisted agents. Supported formats include bearer tokens, service-specific headers, basic authentication, and query parameters. **1. Add a connection** Pick a service from the catalog (one click prefills the host and auth scheme) or add a custom origin manually. **2. Paste your credential** Enter the API key, token, or basic-auth value. Presets show the expected format (for example, `Bearer sk-…` or `Basic `). **3. Allowlist it for an agent** Grant specific agents access to the connection. From then on, the agent can call that API from `execute_python`. ### OAuth Connect OAuth 2.0 services by supplying the application details below. After authorization, Corvic securely stores the resulting credentials and refreshes the access token when needed, so agents can continue calling the service without handling tokens directly. You need: * **Client ID**: the public identifier for the OAuth application you registered with the provider. * **Client secret**: the private credential that proves Corvic is acting on behalf of that application. Keep it confidential. * **Scopes**: the permissions your integration needs, such as read access to contacts or permission to create issues. Request only the minimum required scopes. * **Token endpoint URL**: the provider URL Corvic calls to exchange an authorization code for access and refresh tokens, and later to refresh the access token. * **Authorization endpoint URL**: the provider URL where the user signs in and approves the requested scopes. * **Additional authorization parameters**: provider-specific values added to the authorization request. To receive a refresh token, providers may require `access_type=offline`, `prompt=consent`, an `offline_access` scope, or another documented parameter. ### Storage / Databases Cloud storage and database connectors that are not in the catalog are added here. For **cloud storage**, choose Amazon S3 (or an S3-compatible store), Google Cloud Storage, or Azure Storage, and list the buckets or containers the connector may reach; a bucket anyone can read can be added as anonymous, with no credential. For **databases**, add an Oracle database by its host, port, and service name. #### Oracle With change data capture (CDC), Corvic keeps tables up to date from your Oracle database's committed changes. Corvic reads each table once as a snapshot, then follows each committed insert, update, and delete. Corvic logs in and reads those changes from the redo and archive logs with LogMiner, on the pipeline's schedule. Changes show up when the pipeline runs, as often as every minute. Nothing is installed in your database. You create the users below, and the database makes no outbound connection to Corvic. Corvic reaches the database over [Private Networking](https://docs.corvic.ai/features/private-networking.md) or from [Dedicated IP](https://docs.corvic.ai/features/dedicated-ip.md) addresses. On a private network, database traffic, including CDC, uses Corvic's source range to the listener. **What your database needs** * **ARCHIVELOG mode.** Turning it on takes a database restart. Keep archived logs longer than the longest gap between pipeline runs. If a log from that gap is gone, Corvic takes a new snapshot of the table. * **Supplemental logging** of primary key columns, so each update and delete logs the key of the row it changed. A table keyed by a unique index needs that index's columns logged too. Corvic supplies `key_log_groups.sql` for those tables. * **A LogMiner user** for Corvic. In a multitenant database, use a common user (a name that starts with `C##`). Corvic supplies `logminer_user.sql`, which creates the user and its LogMiner grants. * **A read-only user for the connector**, with `READ` and `FLASHBACK` on each table. Corvic supplies `query_user.sql`. > [!NOTE] > > A table without a primary key or a unique index on `NOT NULL` columns is tracked by ROWID. Such a table can't have LOB columns or row movement enabled. If changes stop arriving, check ARCHIVELOG and that archived logs still cover the time since the pipeline last ran, the grants from `logminer_user.sql` and `query_user.sql`, and supplemental logging (use `key_log_groups.sql` for a unique-index key). ## TLS certificates Database (Oracle), API key, MCP, OAuth, and cloud storage connectors have an optional **TLS certificates** section for servers that need more than the usual public certificates. Both settings apply only to that connector's own servers. ### Trusted CAs If a server's certificate comes from your own certificate authority, or is self-signed, Corvic can't verify it by default and the connection fails (for Oracle, with ORA-29024). Paste or upload the CA certificate, in PEM, under **Trusted CAs**. Corvic still trusts the usual public roots as well. The connector shows each CA's name and expiry, and warns before one expires. For a database reached over [Corvic Private Networking](https://docs.corvic.ai/features/private-networking.md), add that CA here when the listener certificate is not publicly trusted. ### Client certificate If a server asks clients to present a certificate (mutual TLS), add it under **Client certificate** and **Private key**, in PEM: your certificate first, then any intermediates, and an unencrypted private key. Corvic presents it only to this connector's servers and never gives it to agents. Once saved, the connector shows the certificate's subject, issuer, and expiry, never the key. A `.p12` or `.pfx` file, or an encrypted key, isn't accepted yet: convert it to PEM first. > [!NOTE] > > Two connectors used in the same run can't both bring their own CAs or client certificates for the same server. Corvic refuses such a run rather than guess which connector's certificates apply. ## Visibility, status, and policies * **Visibility.** A connector is created either for your organization or privately for you. A private connector is not visible in an organization room, so that room cannot use it. Create the connector for the organization if a shared room needs it. * **Status and testing.** Each connector shows whether it is working. A test checks the connection in stages (connect, TLS, authenticate, request) and, when a stage fails, says which one and suggests a fix. An OAuth connector shows *needs reconnect* when its sign-in has been refused or has expired. * **Policies.** Organization admins can set organization-level and room-level policies for how connectors are used; they are enforced by default. A run or an API key can use a connector only when it has been given explicit access to it. ## What a connector can reach A connector gives agents the access its credential has, no more and no less. Keep these points in mind when you create one: * **Scope the credential, not the connector.** Corvic doesn't narrow what a credential can do. An API key, a cloud storage credential, or a database user reaches everything its permissions allow, so create one with only the access your agents need: the scopes they use, the buckets they read, the tables they query. * **Some services echo headers back.** Corvic adds your credential to each request to the connector's host. If that service returns request headers in its response, for example a debugging or echo endpoint, agent code can read the credential there. Connect services whose API doesn't do this, or accept that risk for that credential. * **A "read-only" Oracle session isn't a security boundary.** Functions with autonomous transactions, `SELECT … FOR UPDATE`, and database links all run with the connector user's grants. Give the database user only the privileges it needs, rather than relying on a read-only session. * **Members can use connectors they can see.** Any member of your organization can use a connector visible to them in their own agents, without being able to read its secret. Only the connector's owner or an admin can edit it. * **Revoking takes effect at the next run.** An agent run that already received a connector's credentials keeps them until the run ends. To cut access at once, also revoke or rotate the credential at the provider. ## Dedicated IP If a connected service only accepts requests from known IP addresses, turn on [Dedicated IP](https://docs.corvic.ai/features/dedicated-ip.md) for its connection. Its requests then always come from a fixed pair of Corvic addresses that you can allowlist. ## Related Documentation > **[Dedicated IP](https://docs.corvic.ai/features/dedicated-ip.md)** > > Reach services behind an IP allowlist. > **[Corvic Private Networking](https://docs.corvic.ai/features/private-networking.md)** > > Reach databases in your own network over a private link. > **[Room Templates](https://docs.corvic.ai/features/room-templates.md)** > > Templates that rely on these connectors. > **[Agents](https://docs.corvic.ai/features/agents.md)** > > Allowlist connections for an agent. > **[Python & SQL](https://docs.corvic.ai/features/python-sql.md)** > > Call connected APIs from agent code. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.