# Connections

Connections let Treasure AI Studio agents work with data in external services — like a Databricks lakehouse — during a chat. An administrator enables a **connector** for the organization, and each user **authorizes** their own connection to it through a secure OAuth sign-in. Once connected, the agent can access that service on the user's behalf without anyone handling raw credentials.

Connector vs. connection
A **connector** is the integration to a vendor (for example, Databricks). An administrator configures and enables it once for the organization in **Connector Settings**. A **connection** is an individual user's authorization to an enabled connector, created from the **Connections** tab. One connector can have many connections — one per user.

## Objective

Understand what connections are, the difference between the administrator and user roles, how authorization works, and how the agent uses a connection during a chat.

## Prerequisites

- Signed in to Treasure AI Studio ([Getting Started](/products/ai-studio/getting-started))
- Account administrator privileges to configure and enable connectors (administrators only)
- Credentials for the external service's OAuth application (administrators — see the per-connector page, e.g. [Connect Databricks](/products/ai-studio/connections/databricks))


## How Connections Work

Connections use **OAuth 2.0**, so the agent never stores or sees your service password. The flow has three roles:

1. **Administrator configures a connector.** In **Connector Settings**, an administrator registers the vendor's OAuth application details (such as a workspace URL, client ID, and client secret) and enables the connector for the organization.
2. **User authorizes a connection.** From the **Connections** tab, a user clicks **Connect** and signs in to the vendor in a popup. The vendor returns an authorization that Treasure AI stores securely, scoped to that user.
3. **The agent uses the connection.** During a chat, the agent accesses the connected service on the user's behalf. Its sandbox holds only a placeholder token; when it makes a request to the service, the platform swaps in the real access token at the network boundary (refreshing it automatically as it expires). The real credential is never visible to the agent.


The agent never sees your real credentials
The agent's environment only ever contains a placeholder token — never your real credential. When the agent calls the connected service, the platform substitutes the real access token at the network boundary, so the secret is never exposed to the agent or your chat. Tokens are refreshed automatically, so a connection keeps working across sessions until you disconnect it or revoke it on the vendor side.

## Where to Find It

Connections are managed in **Settings** on Web and Desktop:

- **Settings → Connections** — your personal view, where you authorize and remove your own connections.
- **Settings → Connector Settings** — visible to account administrators under the **Organization** section, where connectors are configured and enabled for everyone.


## For Users: Managing Your Connections

Open **Settings → Connections**. The page lists the connectors your administrator has enabled and any connections you have already created.

The Connections page with Databricks listed under Available and a Connect button
### Connect a service

1. Under **Available**, find the connector you want and click **Connect**.
2. A popup opens the vendor's sign-in page. Sign in and approve the requested access.
3. When the popup closes, the service appears in your connected list with the date you connected it.


### Disconnect a service

Click the delete (trash) icon next to a connected service to remove it. The agent immediately loses access through that connection; you can reconnect at any time.

No connectors available?
If the Connections page shows "No connectors have been enabled for this account," ask an administrator to configure and enable a connector in **Connector Settings**.

## For Administrators: Configuring Connectors

Open **Settings → Connector Settings** (under **Organization**). This page lists the connectors configured for your account and lets you add, enable, and remove them.

The Connector Settings page with no connectors configured yet and an Add your first connector button
### Add and configure a connector

1. Click **Add Connector** (or **Add your first connector**).
2. In **Select Connector**, choose the connector you want to configure.
3. Fill in the configuration form. Fields are specific to each connector — typically the service's URL and an OAuth application's client ID and client secret. Required fields are marked with an asterisk, and secrets are entered as masked password fields.
4. Follow the **Setup Guide** shown on the form to create the OAuth application on the vendor's side and obtain those values. See the per-connector page for details (for example, [Connect Databricks](/products/ai-studio/connections/databricks)).
5. Click **Save**.


### Enable, disable, and remove

- Each configured connector has an **enable/disable** toggle. Only enabled connectors appear to users on the Connections tab.
- Disabling a connector hides it from users and prevents new authorizations. Existing connections are preserved and keep working — to revoke them, delete the connector instead.
- Expand a connector to review its configured values (secrets stay masked), and use the delete (trash) icon to remove it. Deleting a connector also removes the connections people have made to it.


Disabling is not a kill-switch
Disabling a connector stops new authorizations but does **not** interrupt connections that already exist — the agent can still use them. To cut off access immediately, **delete the connector** (this removes every connection to it). You can also revoke the authorization on the vendor side.

Allow egress in your network policy
A connector lists the external **egress domains** it needs to reach. If your account uses a network policy, allow those domains so the agent's sandbox can reach the service — otherwise connections will fail at runtime. The required domains are shown next to each configured connector.

## Available Connectors

| Connector | What It Enables |
|  --- | --- |
| [Databricks](/products/ai-studio/connections/databricks) | The agent explores and visualizes data in your Databricks lakehouse. |


Additional connectors are planned. Connectors that are not yet available do not appear in the catalog.

## Things to Know

- **One connection per connector, per user.** Each user can hold a single connection to a given connector at a time. To switch accounts or workspaces, disconnect and reconnect.
- **Connector configuration is per account.** An administrator configures a connector once for the organization; every user authorizes against that same configuration.
- **Tokens refresh automatically.** Connections keep working across sessions; you only need to reconnect if the authorization is revoked on the vendor side.
- **Disabling preserves existing connections.** Turning a connector off hides it from new authorizations but does not delete connections users already have.


## Verification

After reading this guide, you can:

- [ ] Explain the difference between a connector and a connection
- [ ] As a user, authorize and remove a connection from **Settings → Connections**
- [ ] As an administrator, add, configure, enable, and remove a connector in **Settings → Connector Settings**
- [ ] Describe how the agent uses a connection during a chat and why raw credentials are never exposed


## Troubleshooting

| Issue | Solution |
|  --- | --- |
| Connections page shows no connectors | Ask an administrator to configure and enable a connector in **Connector Settings**. |
| A connection fails when the agent uses it | Confirm the connector's egress domains are allowed in your network policy, and that the connection is still authorized on the vendor side. |
| A connector disappeared from the Connections tab | An administrator may have disabled it. Existing connections are preserved and keep working; the connector reappears if it's re-enabled. |


## Next Steps

- [Connect Databricks](/products/ai-studio/connections/databricks) — Configure and authorize a Databricks connection
- [Skills & Marketplace](/products/ai-studio/skills/skills) — How skills give the agent domain expertise
- [Security & Permissions](/products/ai-studio/security) — How access control works in Studio