Connect vs auth
| Capability | Scope | Example |
|---|---|---|
| auth | Singleton deployment-wide signin provider | Sign in with Scalekit |
| connect | Per-operator external account connection | Connect a user's Shopify, Slack, or Google account |
Connect credentials are stored per operator under an operators map keyed by operator id and plugin name. This is separate from deployment signin and allows different users to authorize different external accounts.
Integration page
The web integrations page reads available connect capabilities and renders connection flows for the current operator. The worker handles provider calls and stores credentials behind the plugin boundary.
- Declare requested scopes accurately in the plugin manifest.
- Use provider labels that match what operators see in the external service.
- Keep account revocation and reconnect flows visible to users.
- Route external writes through action policies even when the OAuth account is connected.