Docebo Connect: connectors and connections for Spanish SMEs

For a Spanish SME running Docebo as the LMS and starting to wire it into the rest of the stack — Workday, HiBob, Microsoft 365, Salesforce — the question that comes up first is the one nobody answers cleanly in the official docs: what is a connector, what is a connection, and where does the audit-friendly credential trail live? The terminology is small but the operational consequences are large. A connector is a reusable piece of integration logic; a connection is the live, credentialed instance of that connector pointed at one specific tenant. Get the distinction right and the team has a clean inventory under Esquema Nacional de Seguridad Annex II. Get it wrong and a single rotated API key can take down ten recipes the team forgot were running.

Connector vs connection — the two-layer model that determines the audit trail

A connector in Docebo Connect (the embedded Workato runtime) is a reusable adapter for a specific external system. The connector for Workday knows how Workday’s REST endpoints are shaped, what authentication it accepts, and what objects (workers, organizations, learning records) it exposes. Connectors are maintained — by Docebo, by Workato, or by the community — and they ship as code, not as configuration.

A connection is the credentialed instance of a connector pointed at one specific tenant. The Workday connector is a single piece of code; the connection “Workday-prod-EU” is that connector loaded with a specific OAuth token, a specific tenant URL, and a specific service-account identity. A second connection “Workday-sandbox” uses the same connector but a different credential set. Recipes do not consume connectors directly — they consume connections, which is the layer where credential rotation, scoping, and access logging actually happen.

For a Spanish SME under INCIBE supply-chain expectations, this two-layer split is the documentation surface that makes “we know which third-party systems Docebo can write to and with what credentials” a one-line answer. The connection inventory is the audit register. The connector inventory is the third-party software bill of materials. Two artifacts, one architectural pattern.

The three connector types and when each is the right call

Docebo Connect organises connectors into three buckets, and the operational discipline is matching the bucket to the workflow rather than picking the most flexible option.

Off-the-shelf connectors are maintained by Docebo or Workato and cover the 400+ enterprise systems an SME is likeliest to integrate with: Workday, Okta, HiBob, BambooHR, Salesforce, Microsoft 365 (Teams, SharePoint, Outlook), Google Workspace, SAP SuccessFactors. The Docebo internal connector also lives here — and the official guidance is unambiguous: do not move or delete it, because the recipe runtime depends on it. Off-the-shelf connectors include pre-built error handling, ship with example recipes, and are covered by the Docebo or Workato support contract. For a Spanish SME with no full-time integration engineer, the operational rule is: if an off-the-shelf connector exists for the target system, install it and stop looking.

Custom community connectors live in the Workato marketplace and are maintained by community contributors — sometimes a single developer, sometimes an organisation backing a niche system. They are the right answer when the target system has no off-the-shelf connector but does have community demand. The trade is real: community connectors get the same six-point evaluation pass any third-party MCP or library gets — maintainer reputation, repository activity, documentation, testing posture, use-case fit, licensing — and they go on the SME’s quarterly review cadence.

HTTP universal connectors are the escape hatch: a generic adapter that talks to any REST API the team can describe in configuration. They are the right answer when the target system has no connector at all and the integration is small enough that custom-coding the request shape is faster than chasing a community option. The cost is that every workflow built on the HTTP connector becomes a snowflake — when the target API changes, the SME owns the breakage with no upstream maintainer to file the ticket against.

The decision tree the team should internalise: off-the-shelf if available; community if not, with the eval pass; HTTP if neither, with a rewrite plan if the integration grows beyond a single recipe. For Kit Digital IA/BI voucher delivery — Segment III SMEs (10-50 employees) up to €12,000, Segment II (3-9 employees) up to €6,000 — the inventory of which connector type backs each integration is part of the deliverable that justifies the digitalisation claim.

Creating a connection — the five-step procedure and the credential hygiene it implies

Creating a connection in Docebo Connect is a five-step procedure, and four of the five steps are credential-handling. Walking through it deliberately is what distinguishes a one-off setup from a repeatable, audit-friendly process.

First, navigate to Connections inside the relevant project folder, click the down-arrow next to “Create recipe”, and select “Create connection.” Project folders are themselves an organisational discipline: one folder per integration domain (HR, identity, comms) keeps the connection inventory legible and lets the SME apply different access rules per folder.

Second, search for the connector by name — typing “Workday” or “HiBob” surfaces the matching off-the-shelf connector with its support level visible. Read the description before clicking through; some connectors have separate variants for “REST API” vs “RaaS reports” and the choice is not reversible without rebuilding all dependent recipes.

Third, configure authentication. The required fields depend on the target system: API keys, OAuth client ID and secret, workspace URLs, service-account credentials, tenant subdomains. The discipline here is to use a service account dedicated to the integration — never a personal user’s credentials — and to record the credential’s purpose, scope, and rotation date in the SME’s secret manager. For a Spanish SME under EU AI Act transparency expectations on AI-augmented workflows, the service account is the identity that all downstream actions trace back to.

Fourth, test the connection by pressing “Connect.” The system validates credentials and confirms reachability. Do not save until the test passes — a saved-but-broken connection looks identical to a working one in the inventory and produces silent recipe failures later.

Fifth, name the connection meaningfully — “Workday-prod-EU” not “Workday1” — and save. The naming convention is the inventory’s primary key; pick one and enforce it across the team. The Docebo-help reference for the full UI walkthrough lives at help.docebo.com for the team members who want screenshots alongside the procedure.

Ready to get started?

Working on this yourself? J4SGON S.L. delivers Docebo Connect, HRIS, SSO and migration work for European organisations — see what a scoped engagement covers or describe your project and we will reply with a written scope.