# Connection lifecycle

Canonical URL: https://docs.fuse.init.inc/guides/connection-lifecycle

Create Connect sessions, activate connections, test, reconnect, and revoke safely.



A connection moves from a one-time Connect session to a durable connection ID you use for actions. Keep credentials out of your app after Connect completes—call Init with the connection ID instead.

## Connect session [#connect-session]

Your backend creates a Connect session for a tenant, provider, and auth kind. The response includes a single-use Connect token for the frontend. The token authenticates Connect routes only; it is not a long-lived API credential.

Register allowed origins and return URLs on the service client before creating sessions. The session expires if Connect is not completed in time—create a new session rather than retrying a consumed token.

## Auth and credentials [#auth-and-credentials]

The frontend completes provider auth with the Connect token:

* **OAuth / app install** — start OAuth (or installation) from Connect; the user returns through the Fuse callback to your registered return URL.
* **Static credentials** — submit provider credentials on the Connect credentials route for client-credential and token providers.

Provider-specific console steps live in each setup guide, for example [Slack setup](/integrations/slack/setup) and [Okta setup](/integrations/okta/setup). See the full list in the [catalog](/integrations).

## Active connection [#active-connection]

On success, Init creates or updates a connection with a stable connection ID. Store that ID with your tenant—action execute, test, reconnect, and delete all key off it.

## Test [#test]

Call the connection test endpoint after Connect (and after reconnect). A successful test means the stored credential can reach the provider; failures usually mean missing scopes, wrong tenant domain, or revoked provider access.

## Reconnect [#reconnect]

Reconnect issues a new Connect session scoped to the existing connection ID. Completing it refreshes credentials without changing the connection ID your product already stores. Use reconnect for credential rotation, expanded scopes, or `reauth_required` states.

## Revoke and delete [#revoke-and-delete]

Delete the connection when access should end. Deletion is asynchronous: the connection enters a deleting state, provider revocation and cleanup run, then the connection is finalized as deleted. Do not execute new actions against a deleting or deleted connection. Prefer delete over abandoning stale credentials.

## Related [#related]

* [Agent consumption golden path](/guides/agent-consumption)
* [Getting started](/getting-started)
* [Execute actions](/guides/execute-actions)
* [Integration catalog](/integrations)