> ## Documentation Index
> Fetch the complete documentation index at: https://netter.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> The four auth modes integrations use, when each applies, and how to rotate credentials.

The catalog uses four auth modes. Each provider's tutorial calls out which one applies—this page is the reference.

## OAuth 2.0 (via Nango)

Most SaaS integrations (Gmail, Slack, Salesforce, Notion, GitHub, Databricks) use OAuth 2.0 brokered by Nango.

**How it works:**

1. You click **Connect** on the provider card.
2. You're redirected to the provider's consent screen.
3. You sign in and approve the requested scopes.
4. Nango stores the access and refresh tokens; the platform never sees the secret.
5. Pipeline code calls `PROXY_URL/<provider>/...`; Nango refreshes the token on every call.

**Redirect URL on the provider side:** `https://api.nango.dev/oauth/callback`. If you're creating the OAuth app yourself, that's the value to paste in.

**Rotation:** OAuth refresh is automatic. If a token is revoked or scopes change, the integration flips to **Error** and shows a **Reconnect** prompt.

## JWT key-pair (via Nango)

Snowflake uses Nango with a JWT key-pair instead of OAuth. You generate an RSA key pair, attach the public key to your Snowflake user, and provide the private key when you connect.

**Rotation:** Generate a new key pair, attach the new public key in Snowflake, save the new private key in the integration. The connection picks up the new key on the next call.

## API key

A few providers (INSEE, Pappers) use a long-lived API key. You paste the key into the connection form; it's stored encrypted server-side.

**Rotation:** Generate a new key in the provider's console. Paste it into **Integrations → \[Provider] → Credentials**. Verify it works, then revoke the old key in the provider.

<Warning>
  Rotating an API key while the old one is still in use causes a brief gap. Save the new key first, verify, then revoke the old one.
</Warning>

## Custom (host + credentials)

PostgreSQL uses a host/port/database/username/password form. No OAuth, no third-party broker—the platform connects directly using `libpq`.

**Network:** the provider must be reachable from the platform's outbound IPs. Add them to your firewall allowlist before testing the connection.

**Rotation:** Update the password in your PostgreSQL instance, then update **Credentials** in the integration.