An outbound connector holds what Hodoflow presents when it calls out: Your org → External Services. It is created once and reused by every workflow step that needs it.
Outcome
A workflow can call an authenticated API without any credential appearing in a step's configuration.
Before you start
Have the credential itself to hand — a token, a key pair, or a client ID and secret. Hodoflow encrypts what you paste and never shows it again.
1. Create the connector
Go to Connectors and choose New Connector. Pick Outbound for the direction, then the Integration Type:
| Type | What it holds |
|---|---|
| HTTP API | Base URL and an authentication method |
| Amazon S3 | Bucket Name, AWS Region, an optional Custom Endpoint URL for S3-compatible stores such as MinIO, Cloudflare R2, or DigitalOcean Spaces, plus Access Key ID and Secret Access Key |
| Snowflake | Account Identifier, Warehouse, Database, optional Schema and Role, plus Username and a Private Key (PEM) |
Name it after the service and the account it authenticates as — see Naming, reuse, rotation, and deletion.
Checkpoint: the connector appears under Connectors → Outbound with status Unverified.
2. Choose an authentication type
HTTP connectors take one of four Authentication Type values:
| Type | Fields |
|---|---|
| None | — |
| Bearer Token | API Token |
| API Key | Header Name and the key itself |
| OAuth 2.0 | Client ID, Client Secret, and optional Advanced token URLs |
OAuth 2.0 is the one type you cannot finish on this form, because the credential is not a string you paste — it is permission someone grants at the provider. See Authorize an OAuth connection below.
The Snowflake private key field takes a pasted PEM or an Upload .pem button. The file is capped at 16 KB and parsed in the browser — the file itself is never uploaded, only the key text you can see in the box.
Authorize an OAuth connection
An OAuth connection needs three things on the form — Client ID, Client Secret, and under Advanced token URLs the provider's Authorization URL and Token Refresh URL — and then one thing that happens elsewhere.
- Register an application with the provider. Where it asks for a redirect URI (some call it a callback URL), give it the exact string shown in the Authorization panel on the saved connector. Providers compare it character for character, so copy it rather than typing it.
- Put the client ID and secret the provider issued on the connector and save.
- Press Authorize in the Authorization panel. You are sent to the provider, you approve the access, and you land back on the connector.
The panel then reads Authorized. From that point Hodoflow renews the access token by itself: workflows keep running without anyone re-approving anything, and the panel showing Token expired is normal — the next run renews it.
If the panel warns that the provider issued no refresh token, the access will stop working when it expires and someone will have to authorize again. Most providers only issue one when the authorization asks for offline access; check the provider's documentation for the extra parameter it wants and add it to the Authorization URL.
If runs start failing with an authorization error, the grant has been revoked or expired beyond renewal — someone removed the application at the provider, or changed the account's password. The connector shows as Failing; press Reauthorize.
Checkpoint: the Authorization panel reads Authorized.
3. Test it
Press Test Connection on the form, or Test connection on a saved connector's page.
A test returns a Verified or Failing badge with a message, plus Last tested, Latency, and the HTTP status where one applies. Testing a saved connector updates its status, so the result shows up on the list and the health cards.
Snowflake is the one type that must be saved before it can be tested, and says so: save the connector first, then run Test Connection.
Checkpoint: the badge reads Verified.
If it reads Failing, the message is specific. See Connection and authentication errors.
4. Use it in a workflow
Add an HTTP Request step in the builder. When your organization has outbound HTTP connectors, the inspector shows a Connector picker at the top, with Credentials injected at run time beneath it. Choose yours and set the method and URL as usual.
For S3 and Snowflake, the connector is chosen by the step type that uses it. See Step types.
Checkpoint: the step shows the connector's name and no credential appears anywhere in the step's configuration.
What Test Request does not do
The Test Request button on an HTTP Request step sends exactly what is in
the inspector, and does not apply the selected connector's credentials. A
test against an authenticated endpoint therefore returns 401 even when the
real run will succeed.
Use Test Connection on the connector to check the credential, and Test Request against a public endpoint to discover a response shape.
Editing a connector later
Secret fields are empty when you reopen a connector, with the placeholder Leave blank to keep current value. Leaving them blank keeps what is stored; typing something replaces it. There is no way to read a stored secret back out of Hodoflow.
Common problems
The Connector picker is not in the step inspector. Your organization has no outbound HTTP connectors yet. The picker only appears when there is something to pick.
Test Connection says the credential is wrong, but it works elsewhere.
Check the Base URL — a trailing path segment or a missing https:// is the
usual cause. The full list of messages is on Connection and authentication
errors.
I edited the connector and now everything fails. A secret field you meant to leave alone was typed into. Re-enter the correct value; the previous one cannot be recovered.
Deleting is refused. Something still points at it. See Naming, reuse, rotation, and deletion.
Next step
API Specs to call a documented API without hand-writing its URLs.