Connections binding
Let people connect their own accounts to your app without your app storing tokens.
What it does
People connect an account such as Google, Microsoft or Slack once, and give your app permission to use it. Your app calls the platform's connection address; the platform adds the credentials and handles refreshing. Your app never sees or stores a token.
How you use it
- Declare each connection in the manifest under bindings.connections, with a name you choose and the provider.
- Call the address the platform provides in CONNECTION_<NAME>_URL.
- The person decides what your app may use, and can take it back.
When it is worth it
When your app signs in to a third-party service with OAuth, or stores users' tokens for one. That is the part that is risky to build and keep safe.