Adding a connector takes four fields and about a minute, and roughly everybody gets stuck on the same one. The client asks how it should authenticate, offers OAuth and a request header, and the correct answer is the third option nobody expects: none.
Why none is right
The key is already in the address. A connector pointed at it is pointed at a door that is already open for whoever holds that URL, so there is nothing left for OAuth to arrange. Choose OAuth anyway and the client goes looking for an authorisation server that was never going to answer; add a bearer header and you have sent a second credential to a server that was not asking for one.
It is not a shortcut around security. It moves the whole of the security to one place — the address — which is a thing you can see, copy, paste and revoke, rather than a flow you have to trust three parties to have implemented correctly.
Where the care goes instead
- Treat the address as the credential, because it is. It belongs in the client and nowhere else — not in a shared document, not in a screenshot of your settings.
- Mint one per client if you like. Revoking a key takes down only the connectors built on it.
- Use the narrow addresses when an assistant has one job. A connector that can only read the inbox cannot post to LinkedIn by mistake.
- Revoke immediately if one gets out. It is instant, and minting another takes a second.
The other half of the answer
The reason an open address is survivable is that the thing behind it is careful on its own account. A campaign takes one action per turn and counts the day's budget from the actions already taken. Anything with your name on it waits for your yes. A pause from LinkedIn is answered as a pause rather than retried into a restriction. An assistant with the address still cannot make your account do twenty things in a minute, because nothing here can.
If you remember one line of this: when the client asks how to authenticate, say none, and leave the headers empty.
Questions people ask
What if a client will not let me choose none?
Then it is asking for a header rather than an identity, and the key goes there instead: X-API-KEY, with the plain address and no key in the path. Every client worth using offers none; the ones that do not are usually old builds, and updating is the shorter road.
One key for everything, or one each?
One each, if you use more than one client. They cost nothing, the dashboard lists them with the last time each was used, and revoking one then takes down one connector rather than all of them.
What happens the moment I revoke one?
Everything built on it stops answering, immediately. A connector left pointing at a revoked key reports that it has no tools, which is the same thing a mistyped address reports — so revoke deliberately, and mint the replacement before you go looking for what broke.