---
title: "Connect an integration via a pasted API key/secret"
method: POST
path: "/integrations/connections"
tags: ["Integrations"]
---

# Connect an integration via a pasted API key/secret

`POST /integrations/connections`

## Request

- Base URL: `https://api.atako.ai`
- URL: `https://api.atako.ai/integrations/connections`
- Auth: HTTP bearer

For OAuth2 connectors without `apiKeyAlt`, use POST /integrations/oauth/{provider}/start instead. `visibility`: 'company' (admins only) or 'personal' (any member) — defaults to 'company' for an admin, 'personal' otherwise. Several connections of one provider are allowed; `displayName` must be unique per provider within its visibility (case-insensitive) — omitted, it defaults to the provider name, suffixed " 2", " 3"… if taken.

## Request body

- object
  - `providerKey` string, required
  - `displayName` string
  - `visibility` 'company' | 'personal'
  - `secret` string: Required for api_key connectors.
  - `externalLabel` string, nullable
  - `config` object, nullable

## Response `201`

- IntegrationConnection: Never includes credential material.
  - `id` string, uuid, required
  - `companyId` string, uuid, nullable
  - `providerKey` string, required
  - `displayName` string, required
  - `authType` 'api_key' | 'oauth2' | 'mcp' | 'internal', required
  - `visibility` 'company' | 'personal': 'company' = shared with the whole company, managed by its admins; 'personal' = visible to, managed and grantable (to their own agents) by its creator only. Another member's personal connections are never returned.
  - `isMine` boolean: Created by the caller.
  - `actions` object[]: List endpoint, custom MCP connections only (providerKey 'mcp', no catalog entry): the active tools, catalog-shaped.
    - `key` string
    - `scope` 'read' | 'write'
    - `description` string
  - `mcp` object: List endpoint, custom MCP connections only.
    - `host` string, nullable
    - `slug` string, nullable
    - `lastSyncedAt` string, nullable
    - `toolCount` integer
    - `enabledCount` integer
    - `pendingReview` integer
  - `status` 'active' | 'error' | 'revoked', required
  - `externalLabel` string, nullable
  - `config` object, nullable
  - `scopes` string[]
  - `lastUsedAt` string, date-time, nullable
  - `createdBy` string, uuid
  - `createdAt` string, date-time, required

## Other responses

- `400`: providerKey required / not_connectable / oauth_required / secret_required / invalid_credentials (a `secretInPath` key containing `/`, `?`, `#` or whitespace, or a `tokenExchange` key the provider refused to exchange for an access token) / config_invalid / config_host_not_public (a `publicHost` config field whose host is private, local or unresolvable — with the offending `field`)
- `401`: Missing, malformed, or invalid bearer token / API key, or revoked session (SESSION_REVOKED).
- `403`: company_admin_required — only a company admin can create a 'company' connection
- `404`: unknown_provider
- `409`: provider_coming_soon — the provider is not open to clients yet (catalog `availability` is `coming_soon`: not functionally validated, admin status, or OAuth app not provisioned); a `message` explains it. Use POST /integrations/{key}/interest ("Notify me") instead. / name_taken — another live connection of this provider already has this displayName in the same visibility. / personal_limit_reached — 50 live personal connections per user.
- `422`: invalid_credentials — the provider did not answer the credential probe with a 2xx (nothing stored). `probeStatus` carries its HTTP status: 401/403 = key refused; another 4xx (422, 404…) = key or configuration (subdomain, account id) refused
- `502`: provider_unavailable — the credential probe got no verdict (provider 5xx or 429, network error, timeout); nothing stored, retry

---

[API](https://skmtc.dev/atako/apis/atako-api.md) · [All operations](https://skmtc.dev/atako/apis/atako-api/llms.txt) · [OpenAPI document](https://skmtc.dev/atako/apis/atako-api/revisions/aa555c56fbd7?raw)