Document connectors and the upgrade to encrypted connections

- Guides > Connectors: using connections, sharing modes, attribution,
  and admin setup (encryption key and rotation, redirect URIs, Google
  Drive, SharePoint, Confluence, S3, MCP presets).
- Integration pages register CONNECTOR_REDIRECT_BASE_URI as-is; the
  ?provider= suffix never matched what the backend sends.
  VITE_GOOGLE_CLIENT_ID is optional.
- Upgrading: set ENCRYPTION_SECRET_KEY before migrating multi-user installs.

docs/content/Guides/Integrations/confluence-connector.mdx

@@ -10,6 +10,10 @@ import { Steps } from 'nextra/components'
 
 Connect your Confluence Cloud workspace to upload and process pages directly as an external knowledge base. Supports page content and attachments (PDFs, Office files, text files, images, and more). Authentication is handled via Atlassian OAuth 2.0 with automatic token refresh.
 
+<Callout type="info">
+Members connect this service from **Settings > Connectors**, and one sign-in serves every source that uses it. Admins can check what is still missing in **Admin > Connectors**. See [Connectors](/Guides/Connectors).
+</Callout>
+
 ## Setup
 
 <Steps>
@@ -18,8 +22,8 @@ Connect your Confluence Cloud workspace to upload and process pages directly as
 
 1. Go to [developer.atlassian.com/console/myapps](https://developer.atlassian.com/console/myapps/) and click **Create** > **OAuth 2.0 integration**
 2. Under **Authorization**, add a callback URL:
-   - Local: `http://localhost:7091/api/connectors/callback?provider=confluence`
-   - Production: `https://yourdomain.com/api/connectors/callback?provider=confluence`
+   - Local: `http://localhost:7091/api/connectors/callback`
+   - Production: `https://yourdomain.com/api/connectors/callback` (the value of `CONNECTOR_REDIRECT_BASE_URI`, registered as-is)
 
 ### Step 2: Configure Permissions
 
@@ -56,7 +60,7 @@ VITE_CONFLUENCE_CLIENT_ID=your-atlassian-client-id
 
 ### Step 5: Restart and Use
 
-Restart your application, then go to the upload section in DocsGPT and select **Confluence** as the source. You'll be redirected to Atlassian to sign in, then can browse spaces and select pages to process.
+Restart your application, then go to **Settings > Connectors** and pick **Confluence**. You'll be redirected to Atlassian to sign in, then can browse spaces and select pages to process.
 
 </Steps>
 
@@ -64,6 +68,6 @@ Restart your application, then go to the upload section in DocsGPT and select **
 
 - **Option not appearing** — Verify `VITE_CONFLUENCE_CLIENT_ID` is set in the frontend `.env`, then restart.
 - **Sign-in popup closes but the account never connects** — The frontend origin is not allowed to receive the result. Add it to `CONNECTOR_ALLOWED_ORIGINS` in the backend `.env`.
-- **Authentication failed** — Check that the callback URL matches exactly, including `?provider=confluence`.
+- **Authentication failed** — Check that the callback URL matches exactly and equals `CONNECTOR_REDIRECT_BASE_URI`, with no query parameters.
 - **No accessible sites** — Ensure the authenticating user has access to at least one Confluence Cloud site.
 - **Permission denied** — Verify that the Confluence API scopes are enabled in your Atlassian app settings.

docs/content/Guides/Integrations/google-drive-connector.mdx

@@ -10,6 +10,10 @@ import { Steps } from 'nextra/components'
 
 Connect your Google Drive account to upload and process files directly as an external knowledge base. Supports Google Workspace files (Docs, Sheets, Slides), Office files, PDFs, text files, CSVs, images, and more. Authentication is handled via Google OAuth 2.0 with automatic token refresh.
 
+<Callout type="info">
+Members connect this service from **Settings > Connectors**, and one sign-in serves every source that uses it. Admins can check what is still missing in **Admin > Connectors**. See [Connectors](/Guides/Connectors).
+</Callout>
+
 ## Setup
 
 <Steps>
@@ -26,8 +30,8 @@ Connect your Google Drive account to upload and process files directly as an ext
 3. Select **Web application** as the application type
 4. Add your DocsGPT URL to **Authorized JavaScript origins** (e.g. `http://localhost:3000`)
 5. Add your callback URL to **Authorized redirect URIs**:
-   - Local: `http://localhost:7091/api/connectors/callback?provider=google_drive`
-   - Production: `https://yourdomain.com/api/connectors/callback?provider=google_drive`
+   - Local: `http://localhost:7091/api/connectors/callback`
+   - Production: `https://yourdomain.com/api/connectors/callback` (the value of `CONNECTOR_REDIRECT_BASE_URI`, registered as-is)
 6. Click **Create** and copy the **Client ID** and **Client Secret**
 
 ### Step 3: Configure Environment Variables
@@ -39,7 +43,7 @@ GOOGLE_CLIENT_ID=your-google-client-id
 GOOGLE_CLIENT_SECRET=your-google-client-secret
 ```
 
-Add to your frontend `.env` file:
+Optionally, to use Google's own file picker instead of DocsGPT's, add to your frontend `.env` file:
 
 ```env
 VITE_GOOGLE_CLIENT_ID=your-google-client-id
@@ -49,23 +53,23 @@ VITE_GOOGLE_CLIENT_ID=your-google-client-id
 |----------|-------------|----------|
 | `GOOGLE_CLIENT_ID` | OAuth Client ID from GCP Credentials | Yes |
 | `GOOGLE_CLIENT_SECRET` | OAuth Client Secret from GCP Credentials | Yes |
-| `VITE_GOOGLE_CLIENT_ID` | Same Client ID, used by the frontend to show the Google Drive option | Yes |
+| `VITE_GOOGLE_CLIENT_ID` | Same Client ID, used by the frontend for Google's file picker | No |
 | `CONNECTOR_ALLOWED_ORIGINS` | Comma-separated frontend origins allowed to receive the sign-in result, e.g. `https://docsgpt.example.com`. Not needed when the frontend shares the API origin, or in local dev when the callback is on `localhost`/`127.0.0.1` and the frontend runs on port 5173 | When the frontend is on its own origin |
 
 <Callout type="warning" emoji="⚠️">
-Make sure to use the same Google Client ID in both backend and frontend configurations.
+If you set `VITE_GOOGLE_CLIENT_ID`, use the same Client ID as the backend. Publish the OAuth consent screen (or use an internal Workspace app): apps left in Testing get refresh tokens that expire after seven days, which stops background sync.
 </Callout>
 
 ### Step 4: Restart and Use
 
-Restart your application, then go to the upload section in DocsGPT and select **Google Drive** as the source. You'll be redirected to Google to sign in, then can browse and select files to process.
+Restart your application, then go to **Settings > Connectors** and pick **Google Drive**. You'll be redirected to Google to sign in, then can browse and select files to process.
 
 </Steps>
 
 ## Troubleshooting
 
-- **Option not appearing** — Verify `VITE_GOOGLE_CLIENT_ID` is set in the frontend `.env`, then restart.
-- **Authentication failed** — Check that the redirect URI matches exactly, including `?provider=google_drive`. Ensure the Google Drive API is enabled.
+- **Shows Needs admin setup** — `GOOGLE_CLIENT_ID` or `GOOGLE_CLIENT_SECRET` is missing from the backend `.env`. Admin > Connectors lists which one.
+- **Authentication failed** — Check that the redirect URI matches exactly and equals `CONNECTOR_REDIRECT_BASE_URI`, with no query parameters. Ensure the Google Drive API is enabled.
 - **Sign-in popup closes but the account never connects** — The frontend origin is not allowed to receive the result. Add it to `CONNECTOR_ALLOWED_ORIGINS` in the backend `.env`.
 - **Permission denied** — Verify the OAuth consent screen is configured and the user has access to the target files.
 - **Files not processing** — Check backend logs and verify that backend environment variables are correctly set.

docs/content/Guides/Integrations/mcp-tool-integration.mdx

@@ -22,11 +22,11 @@ Only needed if your MCP servers use OAuth authentication:
 MCP_OAUTH_REDIRECT_URI=https://yourdomain.com/api/mcp_server/callback
 ```
 
-If not set, falls back to `API_URL/api/mcp_server/callback`.
+If not set, it is derived from the host of `CONNECTOR_REDIRECT_BASE_URI`, then from `API_URL`.
 
 ### Step 2: Add an MCP Server
 
-Go to **Settings** > **Tools** > **Add Tool** > **MCP Server**. Enter the server URL, select an auth type, and click **Test Connection** to verify, then **Save**.
+Go to **Settings** > **Connectors** and pick a preset (Notion, Linear, Atlassian, Sentry, Asana, Stripe), or choose **Add custom connector** > **MCP server**. The same form opens from **Settings** > **Tools** > **Add Tool**. Enter the server URL, select an auth type, and click **Test Connection** to verify, then **Save**.
 
 ### Step 3: Enable for Your Agent
 
@@ -34,6 +34,8 @@ In your agent configuration, enable the MCP tools you want the agent to use.
 
 </Steps>
 
+Presets fill in the server URL and sign in with OAuth. Admins can turn presets off one by one, and turn off custom MCP servers, in **Admin > Connectors**. See [Connectors](/Guides/Connectors).
+
 ## Authentication Types
 
 | Auth Type | Config Fields |

docs/content/Guides/Integrations/sharepoint-connector.mdx

@@ -10,6 +10,10 @@ import { Steps } from 'nextra/components'
 
 Connect your SharePoint or OneDrive account to upload and process files directly as an external knowledge base. Supports Office files, PDFs, text files, CSVs, images, and more. Authentication is handled via Microsoft Entra ID (Azure AD) with automatic token refresh.
 
+<Callout type="info">
+Members connect this service from **Settings > Connectors**, and one sign-in serves every source that uses it. Admins can check what is still missing in **Admin > Connectors**. See [Connectors](/Guides/Connectors).
+</Callout>
+
 ## Setup
 
 <Steps>
@@ -18,8 +22,8 @@ Connect your SharePoint or OneDrive account to upload and process files directly
 
 1. Go to the [Azure Portal](https://portal.azure.com/) > **Microsoft Entra ID** > **App registrations** > **New registration**
 2. Set **Redirect URI** (Web) to:
-   - Local: `http://localhost:7091/api/connectors/callback?provider=share_point`
-   - Production: `https://yourdomain.com/api/connectors/callback?provider=share_point`
+   - Local: `http://localhost:7091/api/connectors/callback`
+   - Production: `https://yourdomain.com/api/connectors/callback` (the value of `CONNECTOR_REDIRECT_BASE_URI`, registered as-is)
 
 ### Step 2: Configure API Permissions
 
@@ -53,13 +57,13 @@ MICROSOFT_TENANT_ID=your-azure-ad-tenant-id
 
 ### Step 5: Restart and Use
 
-Restart your application, then go to the upload section in DocsGPT and select **SharePoint / OneDrive** as the source. You'll be redirected to Microsoft to sign in, then can browse and select files to process.
+Restart your application, then go to **Settings > Connectors** and pick **SharePoint**. You'll be redirected to Microsoft to sign in, then can browse and select files to process.
 
 </Steps>
 
 ## Troubleshooting
 
 - **Option not appearing** — Verify `MICROSOFT_CLIENT_ID` and `MICROSOFT_CLIENT_SECRET` are set, then restart.
-- **Authentication failed** — Check that the redirect URI matches exactly, including `?provider=share_point`.
+- **Authentication failed** — Check that the redirect URI matches exactly and equals `CONNECTOR_REDIRECT_BASE_URI`, with no query parameters.
 - **Sign-in popup closes but the account never connects** — The frontend origin is not allowed to receive the result. Add it to `CONNECTOR_ALLOWED_ORIGINS` in the backend `.env`.
 - **Permission denied** — Ensure admin consent is granted and the user has access to the target files.