Credentials, scope, connection tests, inventory and management capabilities for every supported provider.

Connector reference

A connector is the provider-specific half of a connection. It knows how to authenticate, test the credential, list importable resources and perform the operations that provider actually supports. The platform supplies the project, environment, role, audit and approval boundaries around it.

Open Connectors to see one card per connection. Opening a card shows a live account or project overview. Importing a resource from Resources gives it a durable tracked record, scheduled status and cost collection, and its provider-specific management tabs.

For the exact Import, Provision, Destroy and detail-panel support of every registered type, use the Resource type reference.

Rules shared by every connector

• A connection belongs to one project and may be project-wide or limited to one environment.

• Its secret is encrypted in the platform's secret store and never returned after saving. When editing a connection, leave the secret fields empty to keep the existing credential.

• Every provider call uses that connection's credential. There is no fallback to the platform's own cloud identity when a credential is missing or under-permissioned.

• Test connection verifies authentication using a small provider-specific call. A successful test does not prove the credential can perform every optional operation; Import or a detail tab can still report a missing provider permission.

• Use the narrowest provider role or token scope that supports the reads and changes the connection is meant to perform. A narrow credential may fail one view or produce a partial inventory; connectors with per-kind diagnostics state which reads failed.

Connection fields at a glance

The account ID on an AWS connection is optional and is used where a cross-account operation needs to identify the destination account. The account ID on Cloudflare is different: zones and DNS can work without it, but Pages APIs require it.

AWS

The AWS connection is region-oriented. Test connection calls STS and returns the account ID. The Account view shows the authenticated principal and ARN, home region, reachable regions, and headline VPC and EC2 counts. A root credential is called out because it cannot be narrowed.

The Roles, Users and Groups views manage IAM at account level. Service management is not duplicated there: import the service and open it from Resources.

Import supports App Runner, ECS services, EC2 and bastion hosts, RDS, ElastiCache, load balancers, NAT gateways, Elastic IPs, S3, ECR, API Gateway REST APIs, CodeBuild, VPCs, Lambda, SQS, OpenSearch, security groups, EventBridge rules, CloudFront distributions, ACM certificates, SES identities and the SES account summary.

Provisioning supports most of those types. The exceptions are deliberately visible in the resource type picker; for example the SES account summary is analysis-only. Teardown is narrower again and is offered only for types with a provider-safe delete implementation. Detail panels include capabilities such as deployment, logs, environment and secret management, metrics, database or Redis queries, backups, SSH tunnels, IAM role selection, DNS validation and cross-account or cross-region copying, depending on the resource type.

Because the same AWS key drives all of these calls, a successful STS test only proves the key is valid. An AccessDenied on RDS, IAM or another service means that key needs the corresponding AWS permission—or that the connection should intentionally remain read-only.

MongoDB Atlas

Set the Atlas Project / Group ID as the connection scope and provide an Atlas public/private API key pair. Test connection reads the project and returns its name. An authenticated key can still be refused when its Atlas project role is too narrow; that is an Atlas API-key role, not the signed-in person's xAuto role.

The connector overview has three views:

• Clusters shows lifecycle, tier, region, MongoDB version, cloud backup and point-in-time recovery.

• Database users shows SCRAM and external identities with their database and collection roles.

• Network access combines the IP access list with network containers and peerings, because an allowed private range does not carry traffic without a live peering.

Atlas clusters can be imported or provisioned. A tracked cluster supports lifecycle and scaling, database discovery, cloud snapshots and restore, system dumps, cost estimation and architecture relationships. Access requests can create temporary SCRAM users, temporary AWS-IAM database users, or temporary IP access-list entries; database access can be narrowed by database and collection.

Azure

Provide a service principal's tenant ID, client ID and client secret together with the subscription ID. There is no separate region field: the subscription is the connection boundary and each Azure resource carries its own location. Test connection authenticates and reports the subscription.

The connector card gives a lightweight resource-group overview. Resources can import and provision resource groups, App Services and slots, Container Apps, SQL databases and Storage Accounts. Tracked resource panels add the useful provider-specific operations: application configuration and slot sync, Container App revisions and environment settings, SQL connectivity and database access, and Storage queues and queue synchronization. Cost and architecture data are collected where Azure exposes enough configuration to calculate them.

Azure SQL also participates in self-service access requests: an approved request can create a time-bound database identity and remove it when the grant expires or is revoked.

Azure DevOps

Enter the dev.azure.com organization and the project within it, then store a Personal Access Token. The token is used as the password in Azure DevOps Basic authentication. Test connection lists the pipeline definitions visible to the token and reports the count.

The connector overview lists pipeline definitions. Opening one shows the latest build and its nested stage, phase and job timeline. Importing a definition creates a tracked Azure DevOps pipeline with recent build history, manual run and cancellation actions, and makes it available as a pipeline stage in xAuto.

Provisioning creates a pipeline definition, not its dependencies. The repository, YAML file and—for a GitHub repository—the Azure DevOps service connection must already exist. The form requires the definition name, repository ID, repository type and YAML path.

SendGrid

A SendGrid connection needs one account API key and no region or account field. Test connection reads account information and reports the account type.

The overview shows account type, sender reputation and dynamic templates. Templates can be imported as tracked resources or provisioned by name. The connector does not use the account overview as an email composer; its scope is account visibility plus template creation and tracking.

Firebase Cloud Messaging

Paste the Google service-account JSON for the Firebase project. Test connection performs the OAuth token exchange and reports the project ID; it does not send a notification.

The connector pane is a focused delivery test. Supply one device token, title and body. Dry run is enabled by default and asks FCM to validate the message without delivering it. Turn dry run off only when you intend to send the test notification to that device.

FCM currently has no importable or provisionable resource type, so it appears in Connectors but does not add rows to Resources.

Google Cloud Platform

Paste a Google service-account JSON document and set the connection's default location. Test connection authenticates and reports the Google Cloud project. Enable each Google API the inventory needs; an API that has never been enabled is reported separately from a service-account role that is too narrow.

Inventory covers Cloud Run services and jobs, Cloud Functions, Compute Engine instances, Cloud Storage buckets, Cloud SQL instances, Firestore databases, Memorystore for Redis, VPC networks, load balancers and Pub/Sub topics. The connector overview groups them by kind and preserves per-kind warnings instead of treating an unreadable API as an empty inventory.

Cloud Run services can be provisioned from Resources or a blueprint. Other types are imported and managed from their own detail panels: Cloud Run revisions, logs, access and environment; Cloud SQL lifecycle, configuration, connectivity, databases, users, backups and replicas; VPC subnets, firewalls, routes and peerings; and focused operations for compute, storage, Firestore, Redis, load balancers, Pub/Sub and functions.

Cloudflare

Use a scoped API token created under Cloudflare's API Tokens page. Global API Keys use a different authentication scheme and are not supported. Test connection calls token verification and reports its status.

The account ID is optional for zone and DNS work but required for Pages. The overview shows zones, whether they are active or paused, Pages projects and the latest Production deployment state.

Zones and Pages projects can be imported or provisioned. Registering a zone does not change the domain's nameservers; it remains pending until that delegation is completed outside xAuto. A tracked zone can list, create, edit and remove supported DNS records and states clearly when Cloudflare is paused or not authoritative. A tracked Pages project exposes builds and logs, Production and Preview variables—including write-only secrets—domains and deployment settings. Pages projects can be torn down from xAuto; zones are not offered the same teardown action.

Cloudflare token scope has two dimensions: permissions and included resources. A token can have the right DNS permission but exclude the selected zone, or include the zone but lack DNS Edit. The error shown by the connector distinguishes those cases.

Self-hosted databases

Self-hosted connections are created from Backups, not the generic New connection drawer. Choose PostgreSQL, MongoDB or MySQL; enter the database host, port and login; then choose how the backup worker reaches it:

• Direct connects to the database endpoint from the worker.

• SSH tunnel forwards the database connection through the selected SSH host.

• Remote execution via SSH runs the dump or restore tool on that host.

SSH authentication can use a password or private key, and an existing tracked bastion can prefill the route. Registration tests reachability and creates the tracked server in one operation.

This connector does not discover or provision servers. It discovers databases and tables or collections inside the registered server, creates system-dump backups in an S3 bucket selected from an AWS connection, supports recurring schedules, and restores a dump into a registered self-hosted target. The cloud host and database lifecycle remain outside xAuto.

Diagnosing partial results

Start with Test connection, then read the warning on the provider pane or resource tab. The usual fixes differ:

• authentication failure: replace the stored secret;

• valid credential, missing role or token permission: widen only the provider operation required;

• valid permission, wrong resource scope: include the account, subscription, project or zone;

• GCP service disabled: enable that API rather than changing IAM;

• correct credential but empty result: confirm the connection's project, environment, region or provider account is the one you intended.

After rotating a credential, edit the connection and provide the complete replacement secret, then run Test connection again before diagnosing individual resource tabs.