> For the complete documentation index, see [llms.txt](https://docs.uptiq.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.uptiq.ai/ai-workbench-qore/console/integrations-hub/connect-methods.md).
# Connect methods
How each integration in the Integrations Hub connects: your own credentials, a sandbox account through Kinective, or UDG. Covers credential models and sandbox versus production.
Use this page with [Integrations Hub](/ai-workbench-qore/console/integrations-hub.md).
Browse categories:
* [AI and Utilities](/ai-workbench-qore/console/integrations-hub/ai-and-utilities.md)
* [Banking and Finance](/ai-workbench-qore/console/integrations-hub/banking-and-finance.md)
* [Compliance and Analytics](/ai-workbench-qore/console/integrations-hub/compliance-and-analytics.md)
* [CRM and Marketing](/ai-workbench-qore/console/integrations-hub/crm-and-marketing.md)
* [Productivity and Collaboration](/ai-workbench-qore/console/integrations-hub/productivity-and-collaboration.md)
### Connect BYOK (Bring Your Own Key)
**Used by:** most integrations in the catalog, such as Salesforce, HubSpot, Stripe, Google Workspace, Microsoft 365, Slack, and Twilio.
You supply credentials for your own account with the provider — an API key, an OAuth client ID and secret, or a webhook signing secret. The platform stores them encrypted and uses them at runtime. Some integrations also offer **Use Platform Managed Keys**, so you connect without entering credentials. See [Choose a credential model](#choose-a-credential-model).
#### How it works
1. Open **Integrations** and find the integration in the catalog.
2. Select **Connect** on its card.
3. Enter the credentials the integration asks for:
* **Token-based integrations**: paste your API key.
* **OAuth integrations**, such as Salesforce or Google Workspace: start the OAuth flow. The platform redirects you to the provider's consent screen, then stores the access and refresh tokens.
* **Token and webhook integrations**, such as Stripe: enter your API key and webhook signing secret.
4. The platform validates and encrypts your credentials.
5. The connection is available to agents and apps, in the builders the integration supports.
#### Credential security
* Credentials are encrypted before storage. Fields marked as credential fields are never stored in plaintext.
* When you view a configured integration, credential values display as `******`.
* For OAuth integrations, the platform handles token refresh.
***
### Choose a credential model
An integration's connect form can offer up to three ways to hold its credentials.
| Model | What it means | How to choose it |
| ----------------------------------------------- | -------------------------------------------------------------------------------- | ----------------------------------------------- |
| **Shared credentials** | One set of credentials you enter, used for every run. | The default connect form. |
| **Use per-user credentials** (**ONE-WAY**) | Each user provides their own credentials at runtime, held in their own vault. | Offered only where the integration supports it. |
| **Use Platform Managed Keys** (**RECOMMENDED**) | The platform handles credentials and security, so you connect without any setup. | Offered only where the integration supports it. |
#### Per-user credentials can't be undone
Choosing **Use per-user credentials** shows a warning: *"This setting cannot be undone. Once enabled, you cannot revert to a shared credential model. Every user will need to individually authenticate their own credentials."*
To save it, tick **I understand this is permanent — I cannot revert to a shared credential model after saving.** A **Confirm irreversible change** dialog follows; select **Yes, enable per-user vault**, or **Go back**. Once a connection is saved, the per-user option can't be selected for it.
**How does per-user credential work?**, under the option, describes the flow:
1. **Vault provisioned**—a credential vault is created for each individual user, separate from any shared integration-level vault.
2. **User registers credentials**—each user authenticates once, through OAuth, an API key, or a token, stored in their own vault entry.
3. **Session references the vault**—when an agent session starts, it looks up that user's vault, so no credential is passed on every call.
4. **Runtime resolution**—the platform resolves the correct credential automatically, including after rotations or expirations, without restarting the session.
5. **Isolation enforced**—no user's session can read or use another user's credential.
***
### Sandbox and production
Some integrations connect to a sandbox environment for testing.
* **Sandbox only** — the integration connects with **Connect sandbox account**: *"Test this integration using sandbox credentials."* The core banking integrations work this way.
* **Sandbox or production** — the form shows **Connect sandbox account** (**Available**) and **Production access** (*"Enable live production access"*, marked **Contact sales**). Integrations that work this way include Bill.com, Creditsafe, doola, eBay, Finicity, FreeAgent, Invoiced, Paysafe, QuickBooks, Redtail CRM, and Square.
The category pages mark each integration's connection as sandbox only, or sandbox with production on request.
***
### Sandbox account (core banking through Kinective)
**Used by:** the 20 core banking integrations reached through Kinective.
These integrations are available in **Agent Builder** only. They connect with a sandbox account and use Platform Managed Keys, so there are no credentials to enter. Earlier versions of this guide called this method **MCP Sandbox Account**.
* **Fiserv:** DNA, Portico, Precision, Premier, Signature, Spectrum, XP2
* **FIS:** Bankway, Horizon, IBS, Miser
* **Jack Henry:** CIF 20/20, Core Director, Silverlake, Symitar, Symitar EASE
* **Other:** COCC (DNA) - Insight, Corelation - Keystone, CSI - NuPoint, Finastra - Phoenix
***
### Connect via UDG
**Used by:** 82 integrations across banking, CRM, commerce, customer support, compliance, analytics, and productivity, such as ActiveCampaign, Pipedrive, Shopify, DocuSign, ServiceNow, and Zendesk.
UDG is a managed partner network that brokers connections to providers the platform doesn't connect to directly.
{% hint style="warning" %}
**Not yet available.** UDG integrations are listed in the catalog and counted under **Available**, but their **Connect via UDG** button is disabled. You can't connect one yet.
{% endhint %}
***
### Compare the connect methods
| | Connect BYOK | Sandbox account (Kinective) | Connect via UDG |
| --------------------- | ------------------------------------------------------------------------ | --------------------------- | --------------- |
| **Credentials** | Shared, per-user, or Platform Managed Keys, depending on the integration | Platform Managed Keys | — |
| **Builders** | App Builder, Agent Builder, or both, depending on the integration | Agent Builder | — |
| **Can connect today** | Yes | Yes, sandbox only | No |
| **Integrations** | 106 | 20 | 82 |
A further 20 integrations show **Coming Soon** and can't be connected yet.
***
{% columns %}
{% column width="83.33333333333334%" %}
Maintained by Abhishek Paul
AI-assisted, human-approved
{% endcolumn %}
{% column width="16.666666666666664%" %}
{% endcolumn %}
{% endcolumns %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.uptiq.ai/ai-workbench-qore/console/integrations-hub/connect-methods.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
