Managed Resources
A Managed Resource is a deployed, live instance of a Resource Template — the actual configured connection to an external service with real credentials and environment-specific settings.
While a Resource Template defines what a connection needs, a Managed Resource is that connection in action, ready to be used by workflows at runtime.
Location: Deployment Page > Managed Resources tab
The Managed Resources feature is controlled by a feature flag. Contact your workspace admin if the tab is not visible.
Supported Resource Types
| Type | Description |
|---|---|
| OAuth | OAuth 2.0-based connections to services like Google, Salesforce, or Microsoft. Backed by an IDP and Resource Template. |
| SFTP | Secure File Transfer Protocol server connections. |
| ABS Connection | Azure Blob Storage connections. |
What You Can Do
| Action | Description |
|---|---|
| Create | Deploy a new Managed Resource via a multi-step wizard |
| Edit | Modify an existing resource's configuration |
| View | Inspect resource details in read-only mode |
| Delete | Remove a deployed resource |
| Search | Filter resources by name |
| Filter | Filter the list by resource type (OAuth / SFTP / ABS) |
| Test Connection | Validate credentials per environment |
Creating a Managed Resource
Navigate to the Deployment Page and click the Managed Resources tab, then click Create. The wizard has up to six steps — some steps are conditional based on the resource type and configuration.
Step 1 — Select Resource Type
Pick the type of resource you want to deploy:
- OAuth — Requires an existing Resource Template linked to an IDP.
- SFTP — A direct SFTP server connection (no IDP required).
- ABS Connection — A direct Azure Blob Storage connection (no IDP required).
For OAuth resources, you will select from your organization's available Resource Templates. For SFTP and ABS, the configuration form is self-contained.
Step 2 — Journey Overview
A visual summary of the configuration steps ahead based on your chosen resource type. No input is required on this step.
Step 3 — Resource Details
| Field | Required | Description |
|---|---|---|
| Name | Required | A unique name for this deployed resource. |
| Application | Optional | Associate this resource with a specific application in the workspace. |
| Description | Optional | A description of what this resource connects to. |
| OAuth Flow | Required (OAuth only) | Select the grant type to use: Authorization Code or Client Credentials. |
| Scopes | Optional (OAuth only) | Select the OAuth scopes to request. Default scopes from the Resource Template are pre-selected. |
Step 4 — Environment Settings
Configure credentials for each environment you want this resource to be available in. Click Add Environment to add a row.
Per-Environment Credential Fields
OAuth
| Field | Required | Description |
|---|---|---|
| Environment Name | Required | The environment identifier (e.g., dev, prod). |
| Client ID | Required | The OAuth client ID for this environment. |
| Client Secret | Required | The OAuth client secret for this environment. |
| Scopes | Optional | Override or confirm the scopes for this environment. |
| Auth URLs | Optional | Override the authorization/token URLs from the IDP if needed. |
SFTP
| Field | Required | Description |
|---|---|---|
| Environment Name | Required | The environment identifier. |
| Host | Required | Hostname or IP address of the SFTP server. |
| Port | Required | Port number (default: 22). |
| Username | Required | The SFTP account username. |
| Password | Conditional | Password for password-based authentication. |
| SSH Key | Conditional | Private SSH key for key-based authentication. |
ABS (Azure Blob Storage)
| Field | Required | Description |
|---|---|---|
| Environment Name | Required | The environment identifier. |
| Account Name | Required | The Azure Storage account name. |
| Container Name | Required | The Blob container to connect to. |
| Shared Key | Conditional | Azure Storage account access key. |
| SAS Token | Conditional | Shared Access Signature token for scoped access. |
Test Connection
Each environment row includes a Test Connection button that validates the entered credentials immediately — no need to save first.
Variable Fields
Mark specific credential fields as variable — these fields can be overridden per entity or tenant at runtime (configured in Step 6). This is useful for multi-tenant deployments where different customers use different credentials.
Step 5 — Entity Settings
This step appears when Allow Multi-Tenant is enabled on the linked IDP (OAuth resources only) or when Variable Fields were marked in Step 4.
Define entity tags — context identifiers that Koodisi uses at runtime to resolve the correct credentials for a specific tenant or entity.
Click Add Tag to define a tag:
| Field | Required | Description |
|---|---|---|
| Tag Name | Required | The identifier key (e.g., customerId, tenantId, clientCode). |
| Description | Optional | A human-readable description of what this tag identifies. |
| Required | Optional | If enabled, this tag must be present in the workflow context for the resource to resolve successfully. |
Step 6 — Context Configuration
This step appears when entity tags are defined in Step 5.
Map specific tag values to environment-specific credentials. This allows Koodisi to automatically select the right connection details based on who is executing the workflow.
For each environment, you can create multiple context configurations — one per tenant or entity:
| Field | Description |
|---|---|
| Tag Values | Fill in the values for each entity tag defined in Step 5 (e.g., customerId = acme-corp). |
| Variable Field Overrides | Override any Variable Fields from Step 4 with values specific to this context. |
Bulk Import
Instead of adding context configurations one by one, you can bulk import them from a CSV or JSON file. This is especially useful when onboarding many tenants at once.
OAuth Connection Flow
For OAuth resources, Koodisi supports the following connection actions:
| Action | Description |
|---|---|
| Initiate | Starts the Authorization Code flow — opens the provider's login page so a user can authorize access. |
| Test | Validates that the configured credentials can successfully obtain a token from the provider. |
| Save | Stores the obtained credentials for this Managed Resource. |
Supported flows: Authorization Code, Client Credentials, and Refresh Token.
Editing a Managed Resource
- Navigate to Deployment Page > Managed Resources.
- Locate the resource you want to modify.
- Click the Edit icon.
- Update the configuration and click Save.
Deleting a Managed Resource
- Navigate to Deployment Page > Managed Resources.
- Click the Delete icon next to the resource.
- Confirm the deletion in the dialog.
Deleting a Managed Resource will immediately stop workflows that depend on it from resolving this connection. Ensure no active workflows are using this resource before deleting.
Key Use Cases
Integrate Google Sheets into Workflows
- Create a Google IDP with Authorization Code grant type.
- Create a Resource Template linked to that IDP with the required Google Sheets scopes (e.g.,
https://www.googleapis.com/auth/spreadsheets). - Deploy a Managed Resource with credentials for your dev and prod environments.
- Click Test Connection per environment to validate.
- Use the resource in your workflows via the REST Client or HTTP activities.
Multi-Tenant SaaS with Per-Customer Credentials
- Enable Allow Multi-Tenant on the IDP.
- Create a Resource Template and deploy a Managed Resource.
- In Step 5 — Entity Settings, define a
customerIdtag. - In Step 6 — Context Configuration, add one context entry per customer with their unique credentials.
- At runtime, Koodisi reads
customerIdfrom the workflow context and resolves the matching credentials automatically.
SFTP Server File Processing
- In Step 1, select SFTP as the resource type.
- Configure host, port, username, and authentication (password or SSH key) per environment.
- Define entity contexts for different client sites if they each have separate SFTP servers.
- Click Test Connection to validate each environment.
Azure Blob Storage Access
- In Step 1, select ABS Connection as the resource type.
- Configure account name, container, and authentication (Shared Key or SAS Token) per environment.
- Click Test Connection to validate each environment.
End-to-End Flow
The full external service integration lifecycle is:
IDP Setup → Resource Template Creation → Managed Resource Deployment → Connection Testing
With multi-environment and multi-tenant support at every stage.