Connections

A connection is stored credentials a workflow uses to talk to a third-party service (Stripe API key, OpenAI key, Slack webhook URL, an SMTP user/password, an OAuth2 client, etc.). Connections are defined and stored in WP-PFManagement; WP-PFWorkflow reads them Management-first and executes with them. See OAuth outbound and OAuth Client.

Why connections instead of putting credentials in each node

One place to rotate. Change the credential once in Management; every workflow that uses the connection picks it up automatically.
Encrypted at rest. Connection values are held in Management's encrypted field; the REST surface never returns the raw value, only a masked preview (sk-***-3f8a).
Capability-gated. Managing connections is gated in Management; a workflow author can USE a connection but never sees its value.
Auditable. Every use of a connection in an execution is logged with the connection id, so you can answer "which workflow used this API key in the last week" trivially.

Creating a connection

Create it in WP-PFManagement (the connections / OAuth Client configuration): pick a type (API key, OAuth2 client, basic auth, bearer, SMTP, custom), fill in the fields, and — for OAuth — authorize with the provider. WP-PFWorkflow's own "Connected apps" panel has been retired; the definition now lives in Management.

Using a connection in a node

Any node that talks to an external service has a Connection selector at the top of its configuration. It lists the connections of the relevant type defined in Management. Pick one and the node uses it for every execution.

OAuth2 connections

For services that require an interactive OAuth2 flow (Google APIs, Microsoft Graph, Slack OAuth, etc.), WP-PFWorkflow runs the flow and writes the issued token back to Management. The tokens live only in Management; access tokens are refreshed automatically before each request without operator intervention.

Where they are stored

In WP-PFManagement, in its encrypted store. WP-PFWorkflow keeps no user-facing connection store of its own — it reads each connection's definition from Management and, for OAuth, never keeps a local token copy.