VOCION
Get a demo
docs/concepts/connectors.md

Connectors and credentials

Connectors and sources

A connector is a kind of system Vocion can read (HubSpot, Gmail, Slack, GitHub…). A source is one configured connection in a workspace: sources/<slug>.yaml, with a kind, config and a sync schedule. Synced documents are chunked, embedded and searchable with hybrid vector + keyword retrieval on pgvector.

Built-in kinds: web, local-files, file-import, hubspot, strapi, jira, google-ads, ga4, gmail, google-calendar, granola, slack, drive, zoom, s3, apollo, notion, posthog, github, rest, sentry, slate, elevenlabs.

  • HubSpot
  • Apollo
  • Gmail
  • Google Calendar
  • Slack
  • Zoom
  • Granola
  • Slate
  • Google Drive
  • Notion
  • Strapi
  • GitHub
  • Jira
  • Sentry
  • PostHog
  • Google Analytics 4
  • Google Ads
  • Amazon S3
  • ElevenLabs
  • Web pages and feeds
  • File import
  • REST API in YAML

Manage them at Connectors (/dashboard/connectors). Sync on demand with POST /api/v1/sources/{slug}/sync or npm run sync:source.

Connecting: log in with the vendor

Google, Slack, Atlassian, HubSpot, Notion, Zoom, Apollo, GitHub and PostHog connect with one click: Connect with <vendor> on the Connectors page or in chat. The login runs on a vendor OAuth app, resolved in this order:

  1. The workspace's own login app (client ID and secret saved under Developers → API credentials; the form shows the redirect URL to register)
  2. The server's environment (GOOGLE_OAUTH_CLIENT_ID, SLACK_CLIENT_ID, …)

Each login remembers the app it ran on, so refreshes keep working; replacing the app asks for a new login. Connecting a new source always waits for a person's approval.

Keys the workspace supplies

A workspace can store its own model and tool keys (OpenAI, Anthropic, Vertex, Azure OpenAI, AWS, Tavily, Brave, Firecrawl…) under Developers → API credentials. Every outbound call uses the workspace's key first, the server's environment second, so the workspace's own vendor account is billed. One live key per platform per workspace; saving a new one revokes the old.

Tokens Vocion issues

vcn_live_… bearer tokens are what outside tools present to Vocion. Vocion stores a hash, plus an encrypted copy an admin can reveal. Issue them under Developers, or with npm run tokens:issue. See REST API → Authentication.

Encryption at rest

Stored credentials are encrypted with AES-256-GCM under a per-workspace data key. VOCION_CREDENTIAL_VAULT decides how that key is wrapped: local (with VOCION_CREDENTIAL_VAULT_KEY; development only) or kms (with VOCION_KMS_KEY_ARN; production). See Security.