Managed authentication

Provider definitions describe one or more supported authentication schemes, such as OAuth 2.0, API key, bearer token, or basic authentication.

OAuth flow

1. Your application starts a DataFuse connection flow for a provider.
2. The user authorizes access with that provider.
3. The provider callback returns to DataFuse.
4. DataFuse records the resulting connection for later tool execution.

API keys and other credentials

Credential fields are collected through the connection experience and sent to the server-side integration service. They must not be included in model prompts or logged by the client application.

Execution boundary

When a tool runs, the integration service resolves the connection and applies the credential to the outbound provider request. Known credential values are redacted from playground error messages before those errors are returned.

DataFuse does not currently document an independently audited vault certification on this site. Evaluate deployment, database, and secret-management controls for your own environment before handling sensitive production credentials.