Connections

A connection represents a link between PullPush and an external platform. Each connection has credentials, a direction (source, destination, or both), and one or more data type mappings.

Adding a connection

1. Navigate to Dashboard → Connections → Add Connection
2. Select your platform from the catalog (or use the AI connector builder for unlisted platforms)
3. Enter your API credentials
4. Choose data types to sync
5. Configure direction (source, destination, or bidirectional)

Credential security

All credentials are envelope-encrypted with per-tenant data encryption keys:

• Master key encrypts per-tenant DEKs (data encryption keys)
• DEK encrypts connection credentials using AES-256-GCM
• Plaintext credentials never exist in the database
• Credential rotation is supported without downtime

When code reads a connection's configuration, it must call hydrateConnectionConfig() to decrypt — there is no plaintext shortcut.

Connection states

Testing a connection

After adding credentials, PullPush sends a test request to verify:

• Authentication is valid
• The API endpoint is reachable
• Required permissions are granted

If the test fails, you'll see a specific error message with remediation suggestions.

Multi-location support

For platforms that support multiple locations (Shopify, Linnworks), PullPush maps each location independently. Stock at "Warehouse A" syncs separately from "Warehouse B" — no cross-contamination.

Connection flows

A flow connects a source connection to a destination connection for specific data types. One connection can participate in multiple flows:

Shopify (source) ──→ Flow: orders ──→ Linnworks (destination)
                 ──→ Flow: stock  ──→ Abicart (destination)

HubSpot (source) ──→ Flow: contacts ──→ Xero (destination)
                 ──→ Flow: invoices ──→ Tripletex (destination)

Each flow has independent retry settings, circuit breaker thresholds, and delivery ordering.