Skip to main content

Built-in connection types

The @backstage/connections package provides the canonical connection types in this directory. Each type has its own guide with valid configuration, connection fields, authentication methods, lookup behavior, selection rules, and a typed consumption example.

Cloud accounts and storage​

  • AWS resolves account credentials by AWS account number or Amazon Resource Name (ARN). It supports the account authentication method.
  • AWS S3 represents Amazon Simple Storage Service (S3) and S3-compatible endpoints. It supports none, accessKey, and assumeRole.
  • Azure Blob Storage supports account keys, shared access signature (SAS) tokens, connection strings, Microsoft Entra ID credentials, and unauthenticated access.
  • Google Cloud Storage supports service-account and unauthenticated access.

Source control​

  • AWS CodeCommit supports access keys and role assumption.
  • Azure DevOps supports personal access tokens (PATs), client credentials, managed identities, and unauthenticated access.
  • Bitbucket Cloud supports tokens, app passwords, OAuth client credentials, and unauthenticated access.
  • Bitbucket Server supports tokens, basic authentication, and unauthenticated access.
  • Gerrit supports basic authentication and unauthenticated access.
  • Gitea supports basic authentication and unauthenticated access.
  • GitHub supports tokens, GitHub Apps, and unauthenticated access, including app selection by organization.
  • GitLab supports tokens and unauthenticated access.

Developer platforms​

  • Harness supports token authentication with an optional additional API key.

Common behavior​

Every configured connection supports the framework-owned type, title, match, and auth fields. Every authentication entry supports method, title, and match in addition to the fields defined by its method.

Most built-in types have multiton cardinality and use the host lookup strategy. Their consumers pass query: { url }, and the service selects the connection whose configured host matches the parsed URL host.

AWS is the exception. It is a singleton that accepts accountId or arn in its lookup query and selects an account authentication entry from within the connection.

Unless a type documents its own authentication selection rules, the service returns the first authentication entry visible to the calling plugin. See What happens during find for the complete selection order.

Inspect schemas programmatically​

The connectionTypes registry exposes portable schemas without exposing Zod objects. Generic tooling can inspect the JSON Schema for a connection type and each authentication method:

import { connectionTypes } from '@backstage/connections';

const github = connectionTypes.github;

const connectionSchema = github.configSchema.schema().schema;
const authSchemas = github.authMethods.map(authMethod => ({
  method: authMethod.method,
  title: authMethod.title,
  schema: authMethod.configSchema.schema().schema,
}));

configSchema covers type-specific connection fields. Framework-owned fields are added by the configuration pipeline and are not part of that schema.