Connections

A Connection is one User’s authenticated upstream account or personal credential for one Connector.

Depending on the Connector, it can contain encrypted OAuth tokens or one encrypted typed credential payload. Axec also records safe account metadata, normalized scopes, expiration, credential mode, and any capabilities discovered from a remote MCP system.

Ownership and uniqueness

• The User owns the Connection.
• A User can have at most one active Connection per Connector.
• One upstream subject can have at most one active owner for a Connector.
• An autonomous Application cannot use a User Connection.

Replacement, not mutation

Reconnecting creates a new Connection identity:

current Connection revoked
  -> new Connection inserted
  -> existing Grant still pins the old Connection

This prevents a previously approved Grant from silently inheriting a different upstream account or replacement credential. The User must establish authority for the new identity through the authorization flow.

Connection and Grant

A Connection answers which upstream identity exists. A Grant answers which exact Connection and capabilities a User approved for an Application. Both must remain valid at runtime.

Review Grants and GrantBundles to see how reconnecting and revocation propagate.