TL;DR: Ballet acts as an MCP client to external servers. Add a server from the registry or a custom URL under Connectors, authenticate with OAuth or an API key, and its tools become available to steps and agents. OAuth uses discovery + PKCE so most servers connect without pasting tokens.
Developers giving playbooks access to external services that expose an MCP server.
When a connect attempt fails because a token is missing, Ballet probes the server's OAuth discovery endpoints and opens the authorization popup automatically if the server supports it.
Authorization: Bearer ${MY_TOKEN}), referencing Secrets with ${VAR}.| Method | Example services |
|---|---|
| OAuth (discovery + PKCE) | Slack, Linear, Notion, GitHub |
| API key | Brainfish, Stripe, Supabase, Datadog |
| Custom headers | Provider-specific (for example a client ID + secret) |
OAuth tokens are stored in Ballet's per-tenant encrypted secret store and refreshed automatically near expiry.
Reference the connected server's tools from Code steps, or let Ask Ballet wire them while building. A playbook can also attach connectors in its own Connectors panel for playbook-specific access.