# Connect an integration

> Authorize an outside service via 1-click OAuth or an API key.

Every workflow needs credentials. Use **1-click OAuth** for the popular services in our catalog, or an **API key** for everything else.

## OAuth vs API key

- **OAuth** is per-user and refreshes automatically. Use it whenever available.
- **API keys** are service-account style. Use them when OAuth is not an option.

<Callout type="tip">
  When in doubt, OAuth. You can switch to API keys later if needed.
</Callout>

## 1-click OAuth

<Steps>
<Step>
Open **Integrations** from the sidebar and search for the service.

<Screenshot
  src="/guides/connect-integration/search-for-integration.mp4"
  caption="Searching the Integrations page"
/>
</Step>
<Step>
Click **Connect**, sign in, and approve the requested scopes.

<Screenshot
  src="/guides/connect-integration/connect-integration.mp4"
  caption="Connecting an integration via OAuth"
/>
</Step>
<Step>
The credential is saved and ready to use in any workflow.
</Step>
</Steps>

<Callout type="tip">
  Rename the credential if you plan to connect multiple accounts of the same
  service.
</Callout>

## API key

<Steps>
<Step>
Find the service on the **Integrations** page. Non-OAuth services show an API key form.

<Screenshot
  src="/guides/connect-integration/api-key.mp4"
  caption="Connecting an integration via API key"
/>
</Step>
<Step>
Generate a key in the provider's console, paste it into our form, and click **Save**.
</Step>
</Steps>

<Callout type="warning">
  Treat API keys like passwords. Rotate them periodically and revoke from
  General Input when you rotate the source.
</Callout>

## Share with your team

<Steps>
<Step>
Open the credential and click **Share**.

<Screenshot
  src="/guides/connect-integration/share-key.mp4"
  caption="Sharing a credential with the workspace"
/>
</Step>
<Step>
Share with the whole workspace, specific people, or keep it private.
</Step>
</Steps>

<Callout type="note">
  When a workflow uses a shared credential, the workflow runs as the
  credential's owner, not the workflow's runner.
</Callout>