> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bentralabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connectors

A connector gives Bentra access to the Git provider that holds your workflows. Only **GitHub** is supported today. Add connectors under **Settings → Connectors**, and click one to see its details, rotate its credentials, test it, move it and change who it's shared with.

## Who owns and uses a connector

Every connector is **owned by a workspace**. That workspace's team manages it, whoever added it. When you add one, **Owned by** defaults to the workspace you're in; if you belong to several, pick the team it's for. The person who added it is shown as **Added by**, which gives them no extra rights.

A workflow can use a connector its own workspace owns, or one shared with it. A connector can be shared with **selected workspaces** or **every workspace**. Shared workspaces can use it but not change it.

| | Owners and admins | Members |
| - | - | - |
| Add a connector | Owned by any workspace, shared with any | Owned by a workspace they belong to (not the default workspace), shared with their other workspaces |
| Change, rotate, share or delete it | Any connector | Connectors their workspaces own |
| Move it to another workspace | Any connector | Between two workspaces they belong to |
| Share with every workspace | Yes | No |

Members can't add connectors to the default workspace, so it doesn't fill up with personal connectors, and the connectors it owns are managed by owners and admins.

If someone leaves a workspace, they stop managing its connectors and the rest of the team carries on. When you move a connector, the old workspace stays shared while its workflows still use it.

You can't stop sharing a connector with a workspace, or delete it, while workflows there still use it. The connector page lists them under **Used by**; switch them to another connector first. A workspace that owns a connector used by other workspaces can't be deleted until you move the connector.

Bentra uses a connector to:

* list repositories and branches/tags when you create a workflow
* read `.bento/workflow/workflow.yml`, `.bento/form/form.yml` and the README
* hand a token to a runner so it can clone the repository; a runner only gets it for a run its pool is executing
* commit form edits made in Bentra to a branch and open a pull request

## GitHub App (recommended)

Install the app on the repositories your workflows use, not on the whole organization. Bentra and its runners only ever use installation tokens, which expire after an hour.

| Permission | Access | Why |
| - | - | - |
| Metadata | Read | Required by GitHub for every app |
| Contents | Read and write | Read workflow and form files; clone for runs. Write only commits form edits to a branch |
| Pull requests | Read and write | Open a pull request for a form edit |

If you don't edit forms from Bentra, **Contents: Read** and no pull request access are enough.

## Personal access token

Use a **fine-grained** token limited to the same repositories, with the permissions in the table above. A classic token with `repo` scope works but grants access to every repository the user can see. The token acts as its owner, so prefer a dedicated machine user. Runners receive the token itself to clone, which is another reason to prefer the GitHub App.

## Storage

Connector credentials are encrypted with your organization's own data key before they are stored.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.