Connections store the credentials that integration nodes — HTTP request,
Send email, and plugin nodes — use at run time. They are encrypted at rest, so a
flow never embeds a raw secret: it references a connection by name and the engine
resolves the credential when the node runs.
Menu: Connections (/admin/connections, route admin_connections_list).
Installed integrations are listed read-only under Plugins
(/admin/plugins, route admin_plugins_list).
Permissions
Grant these ACL leaves per role under Access → Roles:
| Resource | Grants |
|---|
comerix.connections.view | View the connections list. |
comerix.connections.manage | Create, edit, test, revoke, and delete connections. |
comerix.plugins.view | View the installed-plugins catalog. |
Connections list
/admin/connections (perm comerix.connections.view) lists every connection
for the tenant:
| Column | What it shows |
|---|
| Name | The label flows reference. |
| Type | The connection type — SMTP, API key, Bearer token, Basic auth, OAuth2, … |
| Provider | HTTP, Email, or a plugin provider (Slack, Shopify, …). |
Create a connection
New connection (/admin/connections/new, perm comerix.connections.manage)
is a three-step form:
- Pick a provider — HTTP, Email, Slack, Shopify, and so on. The provider
determines which connection types are offered next.
- Pick a connection type — the credential scheme for that provider.
- Fill the credentials for that type. The fields come from the type’s
schema:
| Connection type | Fields |
|---|
| API key | key |
| Bearer token | token |
| Basic auth | username, password |
| SMTP | host, port, username, password, from_address |
| OAuth2 | browser redirect to the provider; the returned auth code is exchanged for tokens |
OAuth2 connections send you to the provider’s consent screen in the browser.
After you approve, the provider returns an authorization code that the
platform exchanges for access and refresh tokens — you never paste a token
by hand.
Edit a connection
Edit (/admin/connections/{id}/edit, perm comerix.connections.manage)
lets you change non-secret fields. Secret fields (keys, tokens, passwords) show
a placeholder and are only overwritten if you type a new value — leaving a
secret field untouched keeps the stored credential intact.
Test a connection
Test (POST /admin/connections/{id}/test, perm comerix.connections.manage)
runs a provider-specific check so you can confirm the credential works before a
flow depends on it — for example an SMTP handshake for an Email connection, or a
sample HTTP call for an HTTP connection.
Revoke a connection
Revoke (POST …/revoke) applies to OAuth2 and token types: it revokes the
tokens at the provider. Use it when a credential is compromised or no longer
needed but you want to keep the connection record.
Delete a connection
Delete (POST …/delete) removes the connection.
Delete is blocked if a flow or form still references the connection. Repoint
or remove the referencing nodes first, then delete.
Plugins catalog
Plugins (/admin/plugins, perm comerix.plugins.view) is a read-only list
of installed plugins, each with its name, version, description, and the node
types and connection types it adds. Those nodes and connection types are what
you wire up in Flow Studio and configure here.
Plugins are installed and removed by an operator via Composer, not in the
UI. This page only shows what is already installed.
| Plugin | Nodes | Connection types |
|---|
| Shopify | order status lookup, customer upsert, draft order, product lookup, add tags, product upsert | shopify_app, shopify_admin, shopify_oauth, shopify_webhook |
| Slack | post message | slack_webhook (outbound), slack_app (inbound signature) |
| WordPress / WooCommerce | create_post, WooCommerce order status lookup | wordpress_app_password, woocommerce_keys, woocommerce_webhook |
| Magento 2 | newsletter signup, order status lookup | magento_admin |
Where connections are used
- The integration nodes that consume connections live in flows — see
Flows.
- Many templates need a connection wired before their integration nodes will
run — see Marketplace.
