Create a custom connector

​

Who can create connectors

​

How to create a connector

​

Authentication methods

​

Setting up OAuth 2.0

• Authorization URL and Token URL: your provider’s OAuth endpoints (both must be https://).
• Scopes (optional): one per line, or separated by spaces or commas.
• Scope separator (optional): leave blank for the default (space). Some providers require a comma.
• Use PKCE: enable if your provider supports or requires PKCE (Proof Key for Code Exchange), an extension that adds an extra verification step to the authorization flow.

​

Writing connector knowledge files

• Name: a short identifier (for example, Acme Projects API basics).
• Description: a one-line summary of what the file covers, so Lovable picks the right file for the task (for example, Endpoints and request formats for reading and writing Acme Projects boards and tasks.).
• Content: the actual instructions, in Markdown, including the endpoints, examples, and caveats.

​

What to include

1. A one-line summary of what the API does and what it’s for.
2. Key endpoints: method, path, and what each does. Use paths relative to your API base URL (for example, GET /v1/tasks). Lovable routes requests and attaches credentials automatically, so don’t hardcode full URLs or authentication headers.
3. Request examples for the most common operations, as code blocks. Show the exact request body, required parameters, and query options.
4. Response formats: mention wrappers and field names Lovable should expect (for example, “responses are wrapped in a top-level data field”).
5. A notes section for details that commonly cause integration errors: pagination parameters, rate limits, API versioning in paths, async operations, and date or ID formats.

​

What to leave out

• Credentials or secrets: never put tokens, keys, or client secrets in knowledge content. Authentication is configured separately and injected automatically.
• Authentication boilerplate: Lovable doesn’t need instructions for attaching credentials. The connector handles it.
• Marketing copy: promotional language does not help Lovable call the API. Keep knowledge files technical and factual.

​

Example

This connector calls the Acme Projects API to manage projects and tasks.

## Key endpoints

- `GET /v1/projects`: list projects
- `GET /v1/projects/{id}/tasks`: list tasks in a project
- `POST /v1/tasks`: create a task
- `PATCH /v1/tasks/{id}`: update a task (status, assignee, due date)

## Creating a task

```json
POST /v1/tasks
{
  "project_id": "proj_123",
  "title": "Draft launch plan",
  "due_on": "2026-08-01",
  "assignee_id": "user_456"
}
```

## Notes

- All responses are wrapped in a top-level `data` field.
- List endpoints are paginated: pass `limit` (max 100) and the `next_cursor`
  value from the previous response.
- Dates use `YYYY-MM-DD` format; timestamps are ISO 8601 in UTC.
- Rate limit is 60 requests per minute; batch operations should back off
  on `429` responses.

​

Using your connector

1. Users open Connectors, find your connector in the catalog, and select Add connection.
2. They enter the credential values you defined (an API key, username and password, or OAuth Client ID and secret). For OAuth connectors, a popup runs the authorization flow with your provider.
3. Under Who can use this connection, they choose who can use it: only themselves (the default), specific people, or the entire workspace. See Who can use connections and clients.
4. Lovable verifies the credentials by calling the test request you configured.
5. Once connected, the connection can be linked to projects, and Lovable can build apps that call your API, guided by any knowledge files you added.

​

Managing connectors

• Availability: control who can create connections (No one, Editors & admins, or Admins), the same way as for any other connector. A newly created connector starts at Admins. Free and Pro plans have no picker: any workspace member with the editor role or higher can create connections. See Manage connectors in your workspace for the defaults on each plan.
• Edit: update the connector’s details, endpoint, knowledge, and authentication configuration. Some authentication changes are restricted because existing connections store credentials in their current structure: a connector can’t switch between OAuth 2.0 and credential-based authentication, and existing credential field keys are locked. You can still switch between the single-credential methods (bearer token, custom header, or query parameter), or move any credential-based method to Advanced.
• Delete: remove the connector definition from the workspace.

​

Security

• Credential values are entered only when a connection is created, and are stored encrypted by Lovable. They are injected into requests server-side by the connector gateway, and never appear in chat or in project code. Members with access to a connection can view its configuration, where secret values appear masked.
• Workspace-shared connections can be used by other members of the workspace, so only share connections whose data you’re comfortable making available to your team.

​

FAQ