Environment:Infiniflow Ragflow Data Source Credentials
| Knowledge Sources | |
|---|---|
| Domains | Integration, Security |
| Last Updated | 2026-02-12 06:00 GMT |
Overview
Credential environment for third-party data source connectors including Google Drive, Confluence, Jira, Slack, GitLab, Notion, Zendesk, Dropbox, and email (IMAP).
Description
This environment defines the credentials and API tokens required to connect RAGFlow to external data sources for document ingestion. Each connector has its own set of required environment variables for authentication. Credentials are read via `os.environ.get()` at connector initialization time. OAuth-based connectors (Google Drive, Confluence, Jira, Slack) require client ID/secret pairs, while token-based connectors (GitLab, Notion, Zendesk, Dropbox) require API tokens.
Usage
Use this environment when configuring external data source connectors for automated document ingestion. Only the credentials for the specific connectors in use need to be configured. All connector credentials are optional — only required when the respective connector is enabled.
System Requirements
| Category | Requirement | Notes |
|---|---|---|
| Network | Internet access | Required for API calls to external services |
| Software | RAGFlow backend running | Connectors run within the backend process |
Dependencies
No additional system or Python packages beyond the base Python runtime.
Credentials
Google Drive
- `GOOGLE_OAUTH_CREDENTIALS_JSON_STR`: Google OAuth credentials JSON string.
- `GOOGLE_SERVICE_ACCOUNT_JSON_STR`: Google Service Account JSON string.
- `OAUTH_GOOGLE_DRIVE_CLIENT_ID`: OAuth client ID.
- `OAUTH_GOOGLE_DRIVE_CLIENT_SECRET`: OAuth client secret.
- `GOOGLE_DRIVE_WEB_OAUTH_REDIRECT_URI`: OAuth redirect URI.
Confluence
- `CONFLUENCE_URL`: Confluence base URL (required).
- `CONFLUENCE_USERNAME`: Confluence username (required).
- `CONFLUENCE_ACCESS_TOKEN`: Confluence access token (required).
- `CONFLUENCE_IS_CLOUD`: Whether Confluence is cloud-hosted ("true"/"false").
- `CONFLUENCE_SPACE_KEY`: Space key to sync.
Jira
- `JIRA_BASE_URL`: Jira instance base URL (required).
- `JIRA_USER_EMAIL`: Jira user email (required).
- `JIRA_API_TOKEN`: Jira API token (required).
- `JIRA_PROJECT_KEY`: Jira project key.
Slack
- `SLACK_BOT_TOKEN`: Slack bot OAuth token (required).
- `SLACK_CHANNEL`: Target Slack channel name.
GitLab
- `GITLAB_ACCESS_TOKEN`: GitLab personal access token (required).
- `GITLAB_URL`: GitLab instance URL (required).
- `PROJECT_OWNER`: Repository owner (required).
- `PROJECT_NAME`: Repository name (required).
Notion
- `NOTION_INTEGRATION_TOKEN`: Notion integration token (required).
- `NOTION_ROOT_PAGE_ID`: Root page ID to sync (required).
Zendesk
- `ZENDESK_SUBDOMAIN`: Zendesk subdomain (required).
- `ZENDESK_EMAIL`: Zendesk email (required).
- `ZENDESK_TOKEN`: Zendesk API token (required).
Dropbox
- `DROPBOX_ACCESS_TOKEN`: Dropbox access token (required).
Email (IMAP)
- `IMAP_HOST`: IMAP server hostname (required).
- `IMAP_USERNAME`: IMAP username (required).
- `IMAP_PASSWORD`: IMAP password (required).
- `IMAP_PORT`: IMAP port (default: 993).
Discord
- `discord_bot_token`: Discord bot token (required).
- `server_ids`: Comma-separated Discord server IDs.
WARNING: Never commit actual credential values to version control. Use environment variables or a secrets manager.
Quick Install
# Example: Configure Jira connector
export JIRA_BASE_URL="https://your-org.atlassian.net"
export JIRA_USER_EMAIL="your-email@org.com"
export JIRA_API_TOKEN="your-api-token"
export JIRA_PROJECT_KEY="PROJ"
Code Evidence
Connector credential loading from `common/data_source/confluence_connector.py`:
confluence_url = os.environ.get("CONFLUENCE_URL")
username = os.environ.get("CONFLUENCE_USERNAME")
access_token = os.environ.get("CONFLUENCE_ACCESS_TOKEN")
is_cloud = os.environ.get("CONFLUENCE_IS_CLOUD", "true").lower() == "true"
space_key = os.environ.get("CONFLUENCE_SPACE_KEY")
Rate limit configuration from `common/data_source/config.py`:
REQUEST_TIMEOUT_SECONDS = int(os.environ.get("REQUEST_TIMEOUT_SECONDS", "60"))
CONTINUE_ON_CONNECTOR_FAILURE = os.environ.get(
"CONTINUE_ON_CONNECTOR_FAILURE", "true"
).lower() == "true"
Common Errors
| Error Message | Cause | Solution |
|---|---|---|
| `401 Unauthorized` from connector | Invalid or expired API token | Regenerate the API token for the service |
| `Connection timeout` | Network issue or wrong URL | Verify URL and network access to external service |
| `Rate limit exceeded` | Too many API calls | Connector auto-retries with backoff (default 30s wait, 30 max retries) |
Compatibility Notes
- OAuth connectors (Google, Confluence, Jira, Slack) require redirect URI configuration for web-based OAuth flows.
- Token connectors (GitLab, Notion, Zendesk, Dropbox) use simpler API token authentication.
- Connector timeouts: Default `REQUEST_TIMEOUT_SECONDS=60`. Increase for slow networks.
- Failure handling: `CONTINUE_ON_CONNECTOR_FAILURE=true` by default — sync continues even if individual documents fail.