Provider connections
How a credential becomes a usable connection.
A ProviderConnection is one encrypted credential for one provider inside one workspace.
Lifecycle
PENDING ──verify──▶ VERIFIED ──▶ tools provisioned
│
└──────────────▶ ERROR (provider rejected the credential)When you save a credential, PopMCP calls the provider immediately to confirm it works and
to learn which account it belongs to. Only a VERIFIED connection gets MCP tools.
Storage
Credentials are encrypted with AES-256-GCM before they reach the database, decrypted only in the request that needs them, and never returned to a browser or an AI client. A secret field is write-only in the UI. Once saved it is never displayed again.
Accounts under one authorization
Some providers hand out one authorization that can reach many accounts, such as Google Analytics properties, Search Console sites, Xero organisations and Asana workspaces.
For those, PopMCP shows an account picker after authorization. You choose which accounts to connect and which workspace each belongs in, and the chosen account is pinned into the stored credential. Everything downstream sees a fully specified, single-account connection.
Re-connecting
Re-running a connector's connect flow replaces the credential in place. The MCP instance, its access mode and any grants against it survive, so rotating a key does not require re-granting the connector to every client.