Interface: KernelAuthConnection
Defined in: packages/plugin-sdk/src/kernel/auth.ts:16
Rev4 kernel OAuth connections (contract §2, rev4 §K5): host-managed external-service authentication.
Security model (rev4 §K4 heritage): tokens NEVER leave the server. The
plugin only ever sees connection metadata — list/get/connect/revoke —
and uses the connection through api.network.fetch(url, {connectionId}),
which the host proxies server-side and signs with the stored token.
There is no way to resolve the token value inside the sandbox.
v1 supports public OAuth clients with PKCE only (no clientSecret — plugin
code lives in the sandbox and cannot hold one). OAuth client descriptors
are declared statically in the manifest (authClients) and change only by
reinstalling the plugin.
Properties
connectionId
connectionId:
string
Defined in: packages/plugin-sdk/src/kernel/auth.ts:17
createdAt
createdAt:
number
Defined in: packages/plugin-sdk/src/kernel/auth.ts:22
scopes
scopes:
string[]
Defined in: packages/plugin-sdk/src/kernel/auth.ts:20
serviceId
serviceId:
string
Defined in: packages/plugin-sdk/src/kernel/auth.ts:18
serviceName
serviceName:
string
Defined in: packages/plugin-sdk/src/kernel/auth.ts:19
status
status:
"pending"|"connected"|"expired"|"revoked"
Defined in: packages/plugin-sdk/src/kernel/auth.ts:21
updatedAt
updatedAt:
number
Defined in: packages/plugin-sdk/src/kernel/auth.ts:23