Connections
Links to other systems: HTTP, Microsoft 365, e-mail, MCP.
Create and test an HTTP connection
A connection records another system's address and key once, for the whole workspace. Workflows and AI Colleagues use it with just a path; the key stays encrypted on the server. In this guide you create a connection with a bearer token, test it with one call and see that the key can never be read back.
What a connection may do: read, drafts, write
Every connection has an allowed access. Read only lets only GET through, Prepare drafts everything except DELETE, Read and write everything. Flow checks this itself, before the call leaves — even when a workflow or AI Colleague tries something else. Here you see a POST refused, then allowed, and a DELETE that is still not allowed with Drafts.
Keep secrets in a vault
You store a key or password once, with a name, in your environment's vault. Connections and workflows refer to that name; Flow never shows the value again, not even to you. A new key becomes a new version, used at the next call without a restart. In this guide you create a secret, use it in a connection, add a version and see who read it when.
Reference: secret references
Wherever Flow asks for a secret, you refer to it by a name, never with the value itself:
Replacing a secret while others work
You do not replace a key at night when nobody works: it happens while colleagues run workflows and update connections. A new version applies from the next call, also in a workflow that is already running; a version you switch off is no longer used anywhere. The list of connections says which secret no longer works, and when a colleague works on the same connection at the same time, both their change and yours are kept. Below you see both people's screens side by side.
Microsoft 365: connect and send an e-mail
A connection with Microsoft 365 gives workflows and AI Colleagues building blocks for Outlook mail and calendar, Teams and OneDrive/SharePoint. You connect an app registration from Microsoft Entra ID, test the connection and send an e-mail with the building block Outlook · Send email. You need: the tenant ID, client ID and client secret of an app registration with the application permission Mail.Send.
E-mail over SMTP: connect and send
Not every mailbox lives in Microsoft 365. With the connection E-mail (SMTP/IMAP) Flow sends from any mailbox that speaks SMTP — a hosting package, your own mail server. You fill in the server, port, security and an (app) password, test the sign-in and send an e-mail from a workflow. You need: your mail provider's SMTP details.
Connect an MCP server and call a tool
More and more services offer their functions as an MCP server (Model Context Protocol): a list of tools with a name, a description and arguments. Flow connects such a server as a connection; its tools become steps in workflows and tools for AI Colleagues. Tools that change something only work when the connection may write. You need: the MCP server's address (Streamable HTTP, usually ending in /mcp) and possibly a key.