Connected Accounts

Connected Accounts is the OpenEdge credential and authorization center. It lets users connect external providers once and reuse those connections from service instances.

Why It Exists

Without Connected Accounts, every service would need to store its own provider key, webhook token, or OAuth token. That is harder to secure, harder to rotate, and harder for customers to understand.

Connected Accounts centralizes:

• Provider catalog.
• Encrypted API key storage.
• Connection status.
• Scopes and provider metadata.
• Testing and audit events.
• Future OAuth authorization flows.

Supported Providers

Provider	Auth type	Status	Used by
OpenAI-compatible	API key	Available	AI Model Gateway
OpenRouter	API key	Available	AI Model Gateway
DeepSeek	API key	Available	AI Model Gateway
Custom API Key	API key	Available	AI, Webhook Push, plugins
Telegram Bot	API key	Available	Webhook Push
Slack	OAuth/webhook	Planned	Webhook Push
GitHub	OAuth	Planned	Developer automation
Discord	OAuth/webhook	Planned	Community automation

Console Flow

1. Open the Console.
2. Go to Connections.
3. Choose a provider.
4. Enter a display name and API key.
5. Optionally enter a provider base URL.
6. Save and test the connection.
7. Reuse it from AI Model Gateway or Webhook Push service configuration.

API Routes

Console routes require an authenticated console session:

GET    /console/connections/providers
GET    /console/connections
POST   /console/connections/api-key
POST   /console/connections/:id/test
DELETE /console/connections/:id
GET    /console/connections/:provider/start

Example API key connection request:

{
  "provider": "openrouter",
  "display_name": "OpenRouter Production",
  "credentials": {
    "api_key": "sk-or-..."
  },
  "config": {
    "base_url": "https://openrouter.ai/api/v1"
  },
  "scopes": ["chat"]
}

Responses never include the raw secret:

{
  "success": true,
  "data": {
    "id": "conn_...",
    "provider": "openrouter",
    "auth_type": "api_key",
    "display_name": "OpenRouter Production",
    "status": "active",
    "credentials": {
      "api_key": "configured...[REDACTED]"
    }
  }
}

Service References

Services reference a connection with:

{
  "connected_account_id": "conn_..."
}

At runtime, OpenEdge checks:

• The connection belongs to the authenticated user.
• The connection is active.
• The provider is allowed for the calling service.
• The encrypted credential can be decrypted.
• Provider configuration such as base_url passes URL safety checks.

Security Requirements

• Raw API keys exist only in request memory.
• Encrypted credentials are stored in D1.
• The encryption key must be configured as CONFIG_ENCRYPTION_KEY.
• Deleted or inactive connections cannot be used by service calls.
• Connection test results store summaries, not full upstream responses.