System Connections

Manage system-level platform OAuth credentials (client ID / client secret pairs) used by Lumio's services.

Overview

System connections are an operator-managed credential store keyed by platform, held in integration_configs under the sentinel system account. They are distinct from per-user channel connections and from the global system OAuth app used for connect/reconnect.

The single reader is get_system_credential, and its consumers are server-side native emote fetches (Twitch Helix via get_twitch_emote_auth, Trovo via its client id) and playlist sync. System connections are not the source for the global-bot OAuth client: global bot connect/reconnect reads the config [auth] system pair via CredentialResolver::system_pair (see Providers), and channel/bot token refresh follows each row's pinned credential_source.

Configuration

System connections are managed in the admin dashboard at Admin > System (/system), in the System Connections section below system API keys. The section renders one card per platform, each showing a Configured / Not Configured badge. For each platform you can:

• Configure (when unset) or Update (when set) the client_id and client_secret
• Remove the stored credentials

The Client ID is a plain text input and the Client Secret is a password input. The API returns the stored client_id and a has_secret boolean but never the secret itself, so re-saving a platform means re-entering the secret. The Configured / Not Configured badge is driven by has_secret.

Credentials are stored in the integration_configs table (JSONB config column: client_id plus the AES-256-GCM-encrypted secret under client_secret_encrypted) and encrypted at rest. The raw secret is never persisted in plaintext or returned by the API.

Supported Platforms

The section renders a fixed list: twitch, youtube, kick, trovo, discord, spotify.

Permissions

• system-connections:read — view configured platforms and their status
• system-connections:edit — create or update platform credentials
• system-connections:delete — remove platform credentials

The /system page as a whole opens for anyone holding either system-keys:read or system-connections:read. The Configure / Update / Remove controls are not additionally gated in the UI — enforcement is server-side on the permissions above, so an admin without system-connections:edit sees the buttons and gets a 403 from the call.

The dashboard entry itself is gated on admin:access. System admins (is_system: true) implicitly receive all admin permissions.

API

Action	GraphQL	REST
List system connections	adminSystemConnections	GET /v1/admin/system-connections
Create / update credentials	adminUpsertSystemConnection	PUT /v1/admin/system-connections/\{platform\}
Remove credentials	adminDeleteSystemConnection	DELETE /v1/admin/system-connections/\{platform\}