MESH AI PLATFORM / DOCUMENTATION
Authentication & credential references
Separate workspace identity from external API credentials and token lifecycle.
Two independent identities
Portal login identifies the person and establishes organization permissions. An authentication profile identifies how a connector calls an approved external API. A portal session or identity-provider token is not automatically a valid token for that API.
Choose the API's actual contract
API key and static bearer profiles reference registered server-side credentials. OAuth client credentials is for APIs that accept an application identity. Custom login and refresh is for APIs that issue their own access token through an approved login endpoint. Confirm request encoding, field casing, refresh behavior and response names against the API's documentation.
Custom field mappings
A login mapping such as UserName → username means: send the external field UserName using the server-resolved credential field username. It is not a literal username. The password mapping points to a credential field, not a secret value or a nested credential URI. Refresh mappings combine the supported token-state and credential fields. Do not guess upstream field names.
Local and deployed storage
The local development adapter supports scoped macOS Keychain references. Production rejects local adapters and requires a supported server-side secret manager. Keep the credential reference separate from the token-state reference; issued tokens and their versions remain server-side. Changing hosting requires provisioning the approved credential and token-state stores.
Refresh lifecycle
Where supported, the runtime reuses valid stored token state and renews it when necessary. Versioning and fenced updates protect the current token-state pointer. Provider behavior can differ: verify expiry and refresh response fields, and investigate safe diagnostics without displaying tokens.