Connector authentication — Cliodot Documentation

auth.type controls the allowed fields:

OAuth2 (`oauth2`)#

token_url, client_id, client_secret, scopes
Optional flow block for custom token exchange (method, headers, body, extract_token, token_template_prefix, token_descriptor)
Optional fallback if token acquisition fails

Bearer (`bearer`)#

Static bearer token: token
Optional header_name, prefix (defaults to Authorization / Bearer )

Basic (`basic`)#

username, password (or client_id / client_secret)

API Key (`api_key`)#

api_key for fixed header
Optional header_name, header_key, header_value, token_descriptor

None (`none`)#

No additional fields; request is unauthenticated.

Custom (`custom`)#

custom_headers: object or array of { key, value }
custom: arbitrary key/value pairs inserted into requests

Custom with Flow (token exchange)#

Use type: "custom" with a flow block when the API requires a token obtained by calling a separate endpoint first. The connector executes the flow request, extracts the token from the response, caches it (with expiry if extract_expires_in is set), and attaches it to subsequent API requests.

Flow fields:

Field	Required	Description
`url`	Yes	Token endpoint URL
`method`	No	HTTP method (default: POST)
`headers`	No	Request headers (e.g. `Content-Type`)
`body`	No	Request body. Use `{{ auth.assertion }}`, `{{ auth.client_id }}` etc. for credentials from install
`extract_token`	No	JSON path to token in response (e.g. `access_token`, `data.token`)
`extract_expires_in`	No	JSON path to expiry seconds (e.g. `expires_in`)
`token_location`	No	Where to put token: `header`, `query`, or `body`
`token_template_prefix`	No	Prefix for header value (e.g. `Bearer` )

Example (JWT bearer grant):

"auth": {
 "type": "custom",
 "flow": {
   "method": "POST",
   "url": "https://auth.example.com/oauth/token",
   "headers": {
     "Content-Type": "application/x-www-form-urlencoded"
   },
   "body": {
     "grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
     "assertion": "{{ auth.assertion }}",
     "scope": "{{ auth.scope }}"
   },
   "extract_token": "access_token",
   "extract_expires_in": "expires_in",
   "token_location": "header",
   "token_template_prefix": "Bearer "
 }
}

At install time, provide credentials used in the flow body (e.g. auth: { assertion: "eyJ...", scope: "read" }). See connectors/jwt-api-flow.json for a full example.

Fallback Authentication#

Any auth type can include a fallback block (type, credentials) used if the primary method cannot produce a token.

OAuth2 (oauth2)#

Bearer (bearer)#

Basic (basic)#

API Key (api_key)#

None (none)#

Custom (custom)#