Connector hub auth

Connector Hub Auth gives any Connector Hub integration a ready-made way to authenticate: API keys, Basic Auth, Bearer tokens, or a full OAuth2 flow, without writing that logic yourself.

Introduction:
Connector Hub Auth is an add-on for the Connector Hub module. On its own, Connector Hub lets you define a connection to an external service (an "endpoint") and a small plugin that speaks that service's language. What it does not do by itself is decide how that connection proves who it is. Connector Hub Auth fills that gap: it provides a set of ready-made authentication mechanisms, from a simple API key to a full OAuth2 sign-in flow, so a new integration picks one instead of writing its own secret-handling and token-refresh code from scratch.

Features

- Five outbound authentication mechanisms, ready to use: API key, Basic Auth, Bearer token, OAuth2 Client Credentials, and OAuth2 Authorization Code with PKCE (the full flow with a browser consent screen, used for things like "Sign in with Google").
- Two inbound webhook verification mechanisms: HMAC signature (with a configurable algorithm) and Bearer token.
- A single, consistent way for any Connector Hub integration to pick a mechanism, instead of every integration inventing its own.
- A ready-made "Connect" / "Reconnect" action on the Connector Hub endpoint admin screen for any connection that needs a browser-based consent step, so an integration never needs its own custom admin page just for that.
- Secrets are always resolved through the Key module and never stored as plain configuration.
- Automatic token refresh for OAuth2-based connections, handled transparently in the background.
- Use this when building or installing a Connector Hub integration that talks to a service requiring an API key, Basic Auth, a bearer token, or OAuth2, such as a Google API.

Post-Installation

This module is a building block that other Connector Hub integrations use; it is not something you configure on its own. Once an integration that uses it (for example connector_hub_google) is also installed, its connections appear under Configuration > Web services > Connector Hub, where you pick the authentication mechanism and fill in the matching settings (an API key, a bearer token, or an OAuth2 client ID and secret). For a connection using the OAuth2 consent-screen flow, a "Connect" (or "Reconnect") action appears automatically once the connection is saved; using it starts the external service's own consent screen, and the connection shows as connected afterward.

Additional Requirements

- Requires the Key module. Every secret this module handles (an API key, a bearer token, an OAuth2 client secret) is resolved through it, never stored in plain configuration.
- Requires Connector Hub, the generic connection and plugin framework this module builds on.
- Pulls in the firebase/php-jwt library (via Composer) to verify OAuth2 ID tokens.
- Not useful by itself: install it together with a Connector Hub integration that actually talks to an external service.

Recommended modules/libraries

- Connector Hub (required core).
- Connector Hub Google, the first integration built on top of this module, for Google sign-in and Google Calendar.
- Externalauth, if an integration built on this module needs to map an external identity (such as an OAuth2 sign-in) to a Drupal user account.

Similar projects

General-purpose OAuth2 client modules for Drupal solve a related problem but are not integrated with Connector Hub's own connection and plugin model. This module does not try to replace those; it is scoped specifically to what a Connector Hub integration needs, and is only useful alongside Connector Hub itself.

Supporting this Module

No sponsorship links at this time.

Community Documentation

A full developer reference, including the architecture behind this module's authentication providers, lives at [connector-hub.porschmann.be/docs.html](https://connector-hub.porschmann.be/docs.html).