---
title: "Connectors, OAuth, and provider secrets"
section: "Developer Platform"
canonical_url: "https://support.buildwithhq.com/api/connectors-and-oauth.html"
reviewed_at: "2026-09-14"
authority: Official
---

# Connectors, OAuth, and provider secrets

Discover supported connector types and configure data, payment, and OAuth connections without sending raw provider secrets.

## In brief

- **Discovery:** Registered connector catalog
- **Secrets:** References only
- **OAuth:** Authorization code + PKCE

The connector registry tells a client which integration families and capabilities the current gateway supports. The public set includes REST and GraphQL data connectors, outbound webhooks, standard OAuth connections, Stripe payment connectors, and installed services.

## Discover before configuring

```
GET /v1/apps/{saasAppId}/connector-types
GET /v1/apps/{saasAppId}/data-connectors
GET /v1/apps/{saasAppId}/payment-connectors
GET /v1/apps/{saasAppId}/oauth-connections
```

Discovery is permission-filtered and returns public connector metadata—not connector instances belonging to another app, secret references, destination secrets, tenant routing, or internal database connector types.

## Data connectors

REST and GraphQL connectors require public HTTPS endpoints. Mutating operations must be explicitly allowlisted. Create and update requests accept a protected secret reference, never the raw provider credential itself.

## Payment connectors

The current payment connector type is Stripe. Provider endpoints remain server-owned, and both credential and webhook-secret references are required where applicable. Arbitrary provider types and caller-selected provider base URLs are rejected.

## OAuth lifecycle

1. Start an authorization for a registered provider and requested provider scopes.
2. Redirect the user to the returned provider authorization URL.
3. Complete the one-time state with the provider code.
4. Refresh or revoke by the returned connection ID.

The platform uses authorization code + PKCE, one-time hashed state, encrypted token envelopes, and leased refresh/revoke operations. Provider authorization/token endpoints and client credentials are registered server-side.

Important

A secret reference identifies protected server-side material. Do not send the underlying credential in a connector JSON document or store it in frontend state.

---

Capability review: 2026-09-14. [View the canonical guide](https://support.buildwithhq.com/api/connectors-and-oauth.html).