AppConnector injects auth server-side on every request. It’s an adapter behind the source, not something you see at the source level.
Connect, then sync
SourceSpec — no per-source code. Available today:
Two connector kinds
- Managed OAuth — for apps in Pipedream’s registry. Pipedream runs the OAuth dance and proxies the API; you just
connectandsync. - The broker — for apps Pipedream doesn’t have. You deploy one small hosted key-entry form (once), paste the app’s API key into Pipedream via a Connect-Link-style page, and duckbrain proxies through it with the key injected server-side. The key never touches your machine. RevenueCat rides this. Deep dive: the broker guide.
Add a new app
gen-spec reads the app’s Pipedream component, drafts the spec, probes the live API, and refuses if the connector’s shape isn’t supported yet — so a spec never ships broken. Write the draft, re-run with --draft <file> to validate and register it, then smoke-test with sync.