# Outbound connectors

> Store the credentials a workflow presents when it calls an external service, and point a step at them instead of pasting a key.

An outbound connector holds what Hodoflow presents when it calls out:
*Your org → External Services*. It is created once and reused by every workflow
step that needs it.

## Outcome

A workflow can call an authenticated API without any credential appearing in a
step's configuration.

## Before you start

Have the credential itself to hand — a token, a key pair, or a client ID and
secret. Hodoflow encrypts what you paste and never shows it again.

## 1. Create the connector

Go to **Connectors** and choose **New Connector**. Pick **Outbound** for the
direction, then the **Integration Type**:

| Type | What it holds |
|---|---|
| **HTTP API** | **Base URL** and an authentication method |
| **Amazon S3** | **Bucket Name**, **AWS Region**, an optional **Custom Endpoint URL** for S3-compatible stores such as MinIO, Cloudflare R2, or DigitalOcean Spaces, plus **Access Key ID** and **Secret Access Key** |
| **Snowflake** | **Account Identifier**, **Warehouse**, **Database**, optional **Schema** and **Role**, plus **Username** and a **Private Key (PEM)** |

Name it after the service and the account it authenticates as — see [Naming,
reuse, rotation, and deletion](/help/credentials-connections/lifecycle).

**Checkpoint:** the connector appears under **Connectors → Outbound** with
status **Unverified**.

## 2. Choose an authentication type

HTTP connectors take one of four **Authentication Type** values:

| Type | Fields |
|---|---|
| **None** | — |
| **Bearer Token** | **API Token** |
| **API Key** | **Header Name** and the key itself |
| **OAuth 2.0** | **Client ID**, **Client Secret**, and optional **Advanced token URLs** |

**OAuth 2.0** is the one type you cannot finish on this form, because the
credential is not a string you paste — it is permission someone grants at the
provider. See [Authorize an OAuth
connection](#authorize-an-oauth-connection) below.

The Snowflake private key field takes a pasted PEM or an **Upload .pem**
button. The file is capped at 16 KB and parsed in the browser — the file itself
is never uploaded, only the key text you can see in the box.

## Authorize an OAuth connection

An OAuth connection needs three things on the form — **Client ID**, **Client
Secret**, and under **Advanced token URLs** the provider's **Authorization
URL** and **Token Refresh URL** — and then one thing that happens elsewhere.

1. Register an application with the provider. Where it asks for a redirect URI
   (some call it a callback URL), give it the exact string shown in the
   **Authorization** panel on the saved connector. Providers compare it
   character for character, so copy it rather than typing it.
2. Put the client ID and secret the provider issued on the connector and save.
3. Press **Authorize** in the **Authorization** panel. You are sent to the
   provider, you approve the access, and you land back on the connector.

The panel then reads **Authorized**. From that point Hodoflow renews the access
token by itself: workflows keep running without anyone re-approving anything,
and the panel showing **Token expired** is normal — the next run renews it.

**If the panel warns that the provider issued no refresh token**, the access
will stop working when it expires and someone will have to authorize again.
Most providers only issue one when the authorization asks for offline access;
check the provider's documentation for the extra parameter it wants and add it
to the **Authorization URL**.

**If runs start failing with an authorization error**, the grant has been
revoked or expired beyond renewal — someone removed the application at the
provider, or changed the account's password. The connector shows as **Failing**;
press **Reauthorize**.

**Checkpoint:** the Authorization panel reads **Authorized**.

## 3. Test it

Press **Test Connection** on the form, or **Test connection** on a saved
connector's page.

A test returns a **Verified** or **Failing** badge with a message, plus
**Last tested**, **Latency**, and the **HTTP** status where one applies.
Testing a saved connector updates its status, so the result shows up on the
list and the health cards.

Snowflake is the one type that must be saved before it can be tested, and says
so: *save the connector first, then run Test Connection*.

**Checkpoint:** the badge reads **Verified**.

If it reads **Failing**, the message is specific. See [Connection and
authentication errors](/help/credentials-connections/connection-errors).

## 4. Use it in a workflow

Add an **HTTP Request** step in the builder. When your organization has
outbound HTTP connectors, the inspector shows a **Connector** picker at the
top, with *Credentials injected at run time* beneath it. Choose yours and set
the method and URL as usual.

For S3 and Snowflake, the connector is chosen by the step
type that uses it. See [Step types](/help/workflows/step-types).

**Checkpoint:** the step shows the connector's name and no credential appears
anywhere in the step's configuration.

## What Test Request does not do

The **Test Request** button on an HTTP Request step sends exactly what is in
the inspector, and does **not** apply the selected connector's credentials. A
test against an authenticated endpoint therefore returns `401` even when the
real run will succeed.

Use **Test Connection** on the connector to check the credential, and **Test
Request** against a public endpoint to discover a response shape.

## Editing a connector later

Secret fields are empty when you reopen a connector, with the placeholder
*Leave blank to keep current value*. Leaving them blank keeps what is stored;
typing something replaces it. There is no way to read a stored secret back out
of Hodoflow.

## Common problems

**The Connector picker is not in the step inspector.** Your organization has no
outbound HTTP connectors yet. The picker only appears when there is something
to pick.

**Test Connection says the credential is wrong, but it works elsewhere.**
Check the **Base URL** — a trailing path segment or a missing `https://` is the
usual cause. The full list of messages is on [Connection and authentication
errors](/help/credentials-connections/connection-errors).

**I edited the connector and now everything fails.** A secret field you meant
to leave alone was typed into. Re-enter the correct value; the previous one
cannot be recovered.

**Deleting is refused.** Something still points at it. See [Naming, reuse,
rotation, and deletion](/help/credentials-connections/lifecycle).

## Next step

[API Specs](/help/credentials-connections/api-specs) to call a documented API
without hand-writing its URLs.