HTTP

• Header / Parameter NametextRequired

  The name of the header or query parameter, e.g. X-API-Key or api_key

  [1]
• Key ValuepasswordRequired

  The API key value. Stored encrypted.

  [1]
• Send InselectRequired

• Access Key IDtextRequired
• Secret Access KeypasswordRequired

  Stored encrypted.

  [1]
• RegiontextRequired

  e.g. us-east-1

  [1]
• ServicetextRequired

  e.g. execute-api, s3

  [1]
• Session Tokenpassword

  Optional — for temporary STS credentials

  [1]

• UsernametextRequired
• PasswordpasswordRequired

  Stored encrypted.

  [1]

• TokenpasswordRequired

  The bearer token to send in the Authorization header. Stored encrypted.

  [1]

• UsernametextRequired
• PasswordpasswordRequired

  Stored encrypted.

  [1]

• SecretpasswordRequired

  Stored encrypted.

  [1]
• Algorithmselect
• Signature Encodingselect
• Signature HeadertextRequired

  The response header name the computed signature is sent in, e.g. X-Signature.

  [1]
• Signature Prefixtext

  Optional prefix, e.g. sha256=

  [1]
• Timestamp Headertext

  Optional — when set, a unix-seconds timestamp is signed and sent in this header, e.g. X-Timestamp

  [1]

• Client CertificatetextareaRequired

  Client certificate (PEM)

  [1]
• Client Private KeypasswordRequired

  Client private key (PEM)

  [1]
• Private Key Passphrasepassword

  Optional — only needed if the private key above is encrypted. Stored encrypted.

  [1]
• CA Certificatetextarea

  Optional — pin the server CA (PEM)

  [1]

You’ll be redirected to sign in and approve access — your password is never shared with WEXTL.

• Authorization URLurlRequired

  The OAuth 2.0 authorization endpoint URL (e.g. https://auth.example.com/oauth/authorize). Must be a public HTTPS URL — internal/private addresses are rejected.

  [1]
• Token URLurlRequired

  The OAuth 2.0 token endpoint URL (e.g. https://auth.example.com/oauth/token). Must be a public HTTPS URL — internal/private addresses are rejected.

  [1]
• Client IDtextRequired

  The OAuth 2.0 client ID issued by the authorization server.

  [1]
• Client SecretpasswordRequired

  The OAuth 2.0 client secret issued by the authorization server. Stored encrypted — never exposed in blueprints or logs.

  [1]
• Token Endpoint Authselect

  How to send the client ID and secret to the token endpoint. 'Client Secret Post' puts them in the request body (default, most compatible). 'Client Secret Basic' sends them as an HTTP Basic Authorization header instead.

  [1]
• Scopestext

  Space- or comma-separated list of OAuth 2.0 scopes to request (e.g. read write or openid profile). Optional — leave blank if the server grants a default scope.

  [1]
• Audiencetext

  Optional audience parameter sent in the token request (used by some providers such as Auth0).

  [1]
• Promptselect

  Controls whether the authorization server prompts the user for reauthentication or consent. 'consent' forces the consent screen (required by Google to receive a refresh_token with offline access). 'select_account' lets the user pick which account to use.

  [1]
• Access Typeselect

  Google-specific: set to 'offline' to receive a refresh_token that allows renewing access without user interaction. Requires prompt=consent on the first authorization. Leave as 'Default' for providers that do not use this parameter.

  [1]
• Extra Authorization Parametersarray

  Additional query parameters to append to the authorization URL. Use this for provider-specific parameters not covered by the fields above (e.g. hd=example.com for Google Workspace domain hint).

  [1]
• Extra Token Body Parametersarray

  Additional key/value parameters to include in the token-exchange request BODY (urlencoded). Use for provider-specific fields not covered above (e.g. a resource or tenant parameter). Sent when exchanging the authorization code for tokens.

  [1]
• Extra Token Query Parametersarray

  Additional key/value query-string parameters appended to the token-exchange request URL. Rare, but some providers require params in the query string rather than the body.

  [1]
• Extra Refresh Body Parametersarray

  Additional key/value parameters to include in the token REFRESH request BODY (urlencoded). Sent each time the access token is renewed.

  [1]
• Extra Refresh Query Parametersarray

  Additional key/value query-string parameters appended to the token REFRESH request URL.

  [1]

You’ll be redirected to sign in and approve access — your password is never shared with WEXTL.

• Token URLurlRequired

  The OAuth 2.0 token endpoint URL (e.g. https://auth.example.com/oauth/token). Must be a public HTTPS URL — internal/private addresses are rejected.

  [1]
• Client IDtextRequired

  The OAuth 2.0 client ID issued by the authorization server.

  [1]
• Client SecretpasswordRequired

  The OAuth 2.0 client secret issued by the authorization server. Stored encrypted — never exposed in blueprints or logs.

  [1]
• Scopestext

  Space- or comma-separated list of OAuth 2.0 scopes to request (e.g. read write). Optional — leave blank if the server grants a default scope.

  [1]
• Audiencetext

  Optional audience parameter sent in the token request (used by some providers such as Auth0).

  [1]
• Token Endpoint Authselect

  How to send the client ID and secret to the token endpoint. 'Client Secret Post' puts them in the request body (default, most compatible). 'Client Secret Basic' sends them as an HTTP Basic Authorization header instead.

  [1]