Connectors

Connectors let QwenWork access enterprise systems or external services. Administrators maintain enterprise connectors, credentials, and access scopes, and can restrict connectors members add themselves.

​

Enable connector markets

Open AI Assets → Connectors → Market management to configure the official and enterprise markets.

1. Enable the enterprise market, open its configuration, and choose a dedicated or private market.
2. A dedicated market is maintained here; a private market uses an existing enterprise market page.
3. Enter its full page URL and allowed origin. The address includes the page path; the origin contains its scheme, domain, and necessary port, such as https://market.example.com.
4. Save, check the mode, and verify client access.

Permission for members to add connectors themselves is configured separately.

Admin console: configure connector market sources.

​

Create an enterprise connector

1. With the dedicated market enabled, open the list and add a connector. Alternatively, add an existing resource from the official market.
2. In basic information, enter its name, unique identifier, category, and description. Explain which business system it accesses.
3. In authentication and credentials, select no authentication, MCP OAuth 2.1 (DCR), or API Key supplied by the user, according to the service.
4. For API Key authentication, define only the header name and value prefix here. Members enter their own keys in the client. Preserve required spaces in the prefix.
5. In connection protocol, enter the provider's full HTTP service address and validate the configuration.
6. Save and verify the resource and enabled state. Configure publication policies, then have a target member verify an actual connection.

Admin console: maintain enterprise connector resources.

Admin console: enter basic information, authentication, and the service endpoint. MCP is a protocol for connecting tool services. An ordinary web page is not a substitute for an MCP endpoint. Saving a configuration does not grant access to external-system data.

​

Set enterprise connector access

1. Add a publication policy group.
2. Choose allowlist or blocklist, user scope, connector scope, and client targets.
3. For automatic installation, choose specific resources in an allowlist first. All resources cannot be combined with automatic installation.
4. Save and enable. Have members inside and outside the scope check visibility, then verify installation and actual calls.

Blocklists take precedence. The default policy is always enabled, but its allowed resource scope can be edited. Connector visibility does not grant external-system data permissions; check those separately.

​

Restrict connectors members add themselves

Open access policies and select a mode. These rules affect only connectors members add themselves. Connectors installed from the dedicated enterprise market are excluded. Click the mode's save action to apply it. For rule evaluation:

1. Add a rule and enter its name and description.
2. Choose the matching target. Use the service address or connector identifier for remote endpoints or resource identifiers; choose the internal launch-command option for command-based connectors.
3. Enter a regular expression and select users, departments, or groups.
4. Save, enable, and use match testing with a target member and connector information.

Admin console: set the mode and rules for member-added connectors. For example, ^https://crm\.example\.com/mcp$ allows only that full address. Escape periods; ^ and $ require a full match. Test both the allowed address and similar domains that should be denied.

​

Update credentials and troubleshoot

For user-supplied API Keys, members maintain keys in the client. The console does not receive or store their key values. Members replace expired keys; after changing header or authentication settings, ask them to check their connections again. Return to: AI Assets overview