1. 1

   Get an API key and the company ID from Paperclip

   You are hereNot done yet

   Administrator (once)Provider console (one time)

   From the running Paperclip instance. The key only ever needs read access — PAXX's Paperclip connector has no write methods, by interface contract.

2. ✓

   Encrypted credential storage initialized

   Done

   Administrator (once)In the Hub

   Credentials are sealed with AES-256-GCM before they reach the database, and PAXX refuses to store them at all without a key. Initialize it with one click in the Integration Hub, or set the key in the server environment if you would rather manage it yourself.

3. 3

   Paste them into PAXX

   Not done yet

   Administrator (once)In the Hub

   Press Connect. PAXX reads the company record with the key before storing it, so a wrong ID or a revoked key fails here rather than silently emptying the Agents panel.

4. ✓

   Provisioning writes (optional, environment only)

   optionalDone

   Administrator (once)Server environment

   Creating Paperclip projects and workspaces during a provisioning run requires PAPERCLIP_WRITE_ENABLED=true in the server environment. This one is deliberately not available in the Hub: Paperclip is production-like infrastructure, and a browser session must not be able to grant itself write access to it. Reads work without it.

   This step cannot be completed from the browser — it needs shell access to the server environment and a restart to pick the value up.

Paste the Paperclip API key and company ID; PAXX verifies them before storing.

GET /api/companies/{id} on the configured Paperclip instance — a read, which is the only thing this credential can do.

What PAXX asks the provider for. The provider's own consent screen is the authoritative grant — this list is what will be requested, and after connecting, what was actually returned.

• readRead agentsnot requested yetAgent roster and blocked-agent state.
• readRead projectsnot requested yetPaperclip project list and company record.

• Agent roster

  readNot available

  Every agent with its real status, role and pause/error reason.

  Available once this provider is connected.

  Dashboard → Agents/paxx

• Blocked agents as attention

  readNot available

  A blocked agent is work needing a human just as much as a blocked issue is.

  Available once this provider is connected.

  Dashboard → Attention

• Projects and company

  readNot available

  The Paperclip project list and company record behind the PAXX portal.

  Available once this provider is connected.

  /paxxDashboard → Projects