A managed provider connection lets you authorize an external service through its browser sign-in page. Panels stores the resulting refresh credential encrypted and exposes only connection metadata to the UI and MCP.
Permissions: Team Admin or owner role required to connect, reconnect, or revoke an account. Team members can read connection metadata.

​
Prerequisites

  • Your Panels operator has configured the provider on the edge service.
  • You have an account with the provider and permission to grant the displayed scopes.
  • Your browser accepts secure, first-party cookies for the Panels domain.

​
Set up the connection

1

Open managed provider connections

Open Settings, select Integrations, and find the provider you want to authorize.
2

Authorize the provider

Click Connect account. Panels opens the provider’s authorization page with the configured audience and scope allowlist.Review the provider’s consent screen, then approve or deny access. You must complete this step in the browser that started the connection.
3

Confirm the connection status

Panels returns you to Integrations and shows the account label, stable connection ID, granted scopes, and status.A connection with Reconnect required cannot authorize new provider requests. Click Reconnect to repeat the provider flow.
Call core_list_provider_connections from MCP to retrieve stable connection IDs and metadata. The tool never returns provider credentials or ciphertext.

​
Reference a connection from a node

Python source, transform, and writeback definitions can retain a managed connection reference:
The definition stores only the stable connection_id and its requested scope boundary. At dispatch, Panels copies the reference into the sealed run payload. A trusted worker may request a short-lived broker grant bound to that exact workspace, project, node, run, worker, destination, and operation. Connector support controls whether the governed egress boundary can redeem the grant; unsupported connectors keep the reference as metadata and do not receive an access token.

​
Connection metadata

​
Reconnect or revoke access

Use Reconnect when the provider expires or rejects the refresh credential. Reconnecting preserves the connection ID, so node references do not change. Use Revoke to prevent new access-token minting immediately. Revocation in Panels does not necessarily revoke the provider-side grant; use the provider’s account settings when you also need to remove that grant.
A revoked or expired connection fails closed. Panels does not fall back to another account, a static API key, or a broader scope.

​
How Panels protects provider credentials

  • Authorization uses Authorization Code with PKCE S256.
  • Panels stores a SHA-256 digest of the one-time state and encrypts the PKCE verifier.
  • A secure, HTTP-only cookie binds completion to the browser that started authorization.
  • Panels rechecks the initiating administrator’s current team role before exchanging the code.
  • Panels encrypts refresh credentials with Vault Transit or the configured development encryptor.
  • Panels stores only SHA-256 digests of short-lived, one-time broker grants and rechecks the live worker claim at issuance and redemption.
  • Panels does not persist access tokens. The internal resolver refreshes them only after broker redemption for a specific audience and scope subset.
  • REST and MCP responses use metadata-only projections.

​
Use a managed connection in Python

Declare the connection reference on the Python query, source, or writeback, then call the built-in governed request API with a relative provider path:
provider_request accepts bytes, text, or a JSON-serializable body and returns status_code, safe headers, body, text, and .json(). It cannot accept an absolute URL or an Authorization, cookie, forwarding, proxy, host, method/path override, or hop-by-hop header. The provider origin, allowed methods/path prefixes/request headers, and byte limits come from operator configuration. Runs with managed connections execute only on the python-governed tier. Python receives the connection metadata and a per-run local socket capability, not a provider token or refresh credential. On production Linux workers, the managed process and its children can create only Unix-domain sockets, so raw HTTP and DNS cannot bypass the gateway. Custom requirements are not supported on this tier; ask your operator to preinstall the package in the governed worker image. Network-backed sandbox helpers (get_connection(), save_file(), and output_table()) are also unavailable in a managed-connection run; use run inputs, provider_request(), and structured or log output. If a connection, method, path, or header is outside deployment policy, the request fails closed.

​
Troubleshooting

Restart the connection from Settings and finish it in the same browser. Private browsing boundaries, cookie deletion, or opening the callback on another device invalidate the browser binding.
The refresh credential expired, failed decryption, or the provider rejected it. Click Reconnect and authorize the account again.
Ask your Panels operator to configure it in PROVIDER_OAUTH_CONFIG_JSON. Providers cannot be added through the browser or MCP.