Blocks that talk to outside systems never hold addresses or passwords themselves. They name a connection: an MQTT broker or an HTTP endpoint you set up once and reuse. Secrets in connections are stored encrypted, are never shown again, and never reach a message, a log, a run record or an export.
Manage connections
- Open Automation, then the header menu, and select Connections.
- Select New connection, pick the Type and select Next.
- Fill in the fields, then Save.
- Select Test to check it.
From a block’s settings, Manage connections opens the same list filtered to the types the block can use.
| Column | Shows |
|---|---|
| Name, Type, Version | The connection |
| In use by | The flows and blocks that use it; No flow uses it. otherwise |
| Warnings | “TLS not verified”, “Certificate ends in n days”, “Certificate expired” |
A connection a flow still uses cannot be deleted: “A flow still uses it (n). Change those nodes first.”
HTTP endpoint
“A base URL with its authentication, for HTTP request nodes.”
| Field | Meaning | Values |
|---|---|---|
| base_url | The base address | http:// or https://, required, up to 512 characters, no ?, # or @ |
| allowed_hosts | Hosts a block may call | exact names or one-level wildcards (*.example.com); default: the base URL’s host |
| auth | Authentication | none, basic, bearer, header, oauth2_client_credentials, aws_sigv4 (signed requests for cloud storage and function APIs) |
| tls_verify | Check the server’s certificate | on (default) |
| Custom CA (PEM) | Trust these CAs instead of the public ones | prefer this to turning verification off |
| Client certificate (PEM), Client key (PEM), Client key password | For servers that ask for a client certificate (mutual TLS) | the key and password are secrets |
Authentication fields:
| auth | Fields |
|---|---|
| basic | username, password (secret) |
| bearer | token (secret), sent as Authorization: Bearer |
| header | header_name (letters, digits, -, up to 64), header_value (secret) |
| oauth2_client_credentials | token_url (https, on the allowed hosts), client_id, client_secret (secret), scope, client_auth (basic or body: where the id and secret go) |
| aws_sigv4 | access_key_id, secret_access_key (secret), session_token (secret, temporary credentials only), region, service |
- OAuth 2 client credentials: the platform fetches a token from the token URL, keeps it until a minute before it expires, and sends it as a bearer token. A
401from the API drops the token so the next call fetches a new one. A refused client fails withoauth_failed. - Signed requests: every request is signed with the access key just before it leaves, so the signature covers what is really sent. Use one endpoint per service and region, with a key that may do only what the flow needs.
- Test sends one request and answers: “The server answered and accepted the credentials.”, “The credentials were rejected.”, “The address is private or not allowed.”, “The certificate could not be verified.”, “The server did not answer in time.” and similar.
MQTT broker
| Field | Meaning | Default | Values |
|---|---|---|---|
| host | The broker’s name or address | required | checked against the address guard on every connect |
| port | Port | 1883 | 1 to 65,535 (8883 is usual with TLS) |
| tls | Use TLS | off | with a custom CA and a client certificate for mutual TLS |
| tls_verify | Check the broker’s certificate | on | |
| protocol | MQTT version | 5 | 3.1.1, 5 |
| client_id_mode | suffixed (a base plus a unique suffix per connection) or fixed (exactly as given) | suffixed | |
| client_id | The client id, or its base | none | 256 characters; required when fixed |
| username, password | Credentials | none | the password is a secret |
| topic_prefix | What ~/ in a topic stands for | none | 256 characters |
| keepalive_s | Keep-alive | 60 | 1 to 65,535 s |
| connect_timeout_ms | Time to connect | 10,000 | 1,000 to 60,000 |
| clean_session | Start each connection with an empty session | on | |
| session_expiry_s | MQTT 5, clean session off: how long the broker keeps the session | 300 | 1 to 86,400 s |
- Use
fixedwhen the broker accepts only one connection per client id (some cloud brokers bind the id to an identity): the platform then keeps exactly one connection for the organisation, broker and id. - QoS 2 needs clean session off to survive a dropped connection.
- Test opens one connection and reports “The broker accepted the connection.”, “The broker refused the connection (code n).”, “The credentials were rejected.” and similar.
External time-series database server
A connection for the block that writes to an external time-series database: the Server URL, the allowed hosts, the database’s API version (v2 or v1), then an Organisation and API token (v2) or a Username and Password (v1), and tls_verify. The token and password are secrets. Set it up only if you use that block.
Address rules
- Private, loopback and internal addresses are always refused, on every attempt, after the name is resolved (
ssrf_blocked, “The address is private or not allowed.”). Your connections must point to public addresses. - An HTTP request goes only to the endpoint’s scheme, port and allowed hosts; a path that tries to leave the base path is refused.
- Redirects are not followed.
Secrets
| Rule | Detail |
|---|---|
| Write-only | A stored secret shows “A value is stored. Leave empty to keep it.” Leave the field empty to keep it; type a new value to replace it. |
| Encrypted | Stored encrypted. If the platform has no encryption key set up, saving a secret fails (“Secrets cannot be stored right now…”). |
| Never copied | Secrets never reach messages, run records, logs, the audit log or exports. An imported flow’s connections need their secrets entered again. |
| Concurrent edits | “Someone else changed this connection since you opened it. Your changes were not saved.” Open the latest version and edit again. |
Webhook secrets
A Webhook trigger with token or hmac authentication has a generated secret. Open the editor’s Webhooks dialog (it appears once the flow is deployed and switched on):
| Item | Meaning |
|---|---|
| Address | The URL to call, with Copy |
| Auth | Bearer token, Signed request or Signed-in session |
| Reply | “answers 202 at once”, or “answers with the flow’s reply” |
| Example call | A ready request to copy |
| Make a new secret | A new secret, shown once. “The old one keeps working for another 24 hours, so the callers can switch over.” |
| Revoke the old secret now | A new secret, and the old one stops at once. Use it when the old secret leaked. |
A session webhook has no secret: the caller is a signed-in member of your organisation who holds the Call session-auth webhooks of deployed flows permission (and the block’s extra permission, if set). See Trigger blocks.