diff --git a/packages/app/src/routeTree.gen.ts b/packages/app/src/routeTree.gen.ts
index 56432ab7a..9bc010488 100644
--- a/packages/app/src/routeTree.gen.ts
+++ b/packages/app/src/routeTree.gen.ts
@@ -12,6 +12,7 @@ import { Route as rootRouteImport } from './routes/__root'
 import { Route as ToolsRouteImport } from './routes/tools'
 import { Route as SecretsRouteImport } from './routes/secrets'
 import { Route as PoliciesRouteImport } from './routes/policies'
+import { Route as OauthAppsRouteImport } from './routes/oauth-apps'
 import { Route as IndexRouteImport } from './routes/index'
 import { Route as ResumeExecutionIdRouteImport } from './routes/resume.$executionId'
 import { Route as IntegrationsNamespaceRouteImport } from './routes/integrations.$namespace'
@@ -33,6 +34,11 @@ const PoliciesRoute = PoliciesRouteImport.update({
   path: '/policies',
   getParentRoute: () => rootRouteImport,
 } as any)
+const OauthAppsRoute = OauthAppsRouteImport.update({
+  id: '/oauth-apps',
+  path: '/oauth-apps',
+  getParentRoute: () => rootRouteImport,
+} as any)
 const IndexRoute = IndexRouteImport.update({
   id: '/',
   path: '/',
@@ -62,6 +68,7 @@ const IntegrationsAddPluginKeyRoute =
 
 export interface FileRoutesByFullPath {
   '/': typeof IndexRoute
+  '/oauth-apps': typeof OauthAppsRoute
   '/policies': typeof PoliciesRoute
   '/secrets': typeof SecretsRoute
   '/tools': typeof ToolsRoute
@@ -72,6 +79,7 @@ export interface FileRoutesByFullPath {
 }
 export interface FileRoutesByTo {
   '/': typeof IndexRoute
+  '/oauth-apps': typeof OauthAppsRoute
   '/policies': typeof PoliciesRoute
   '/secrets': typeof SecretsRoute
   '/tools': typeof ToolsRoute
@@ -83,6 +91,7 @@ export interface FileRoutesByTo {
 export interface FileRoutesById {
   __root__: typeof rootRouteImport
   '/': typeof IndexRoute
+  '/oauth-apps': typeof OauthAppsRoute
   '/policies': typeof PoliciesRoute
   '/secrets': typeof SecretsRoute
   '/tools': typeof ToolsRoute
@@ -95,6 +104,7 @@ export interface FileRouteTypes {
   fileRoutesByFullPath: FileRoutesByFullPath
   fullPaths:
     | '/'
+    | '/oauth-apps'
     | '/policies'
     | '/secrets'
     | '/tools'
@@ -105,6 +115,7 @@ export interface FileRouteTypes {
   fileRoutesByTo: FileRoutesByTo
   to:
     | '/'
+    | '/oauth-apps'
     | '/policies'
     | '/secrets'
     | '/tools'
@@ -115,6 +126,7 @@ export interface FileRouteTypes {
   id:
     | '__root__'
     | '/'
+    | '/oauth-apps'
     | '/policies'
     | '/secrets'
     | '/tools'
@@ -126,6 +138,7 @@ export interface FileRouteTypes {
 }
 export interface RootRouteChildren {
   IndexRoute: typeof IndexRoute
+  OauthAppsRoute: typeof OauthAppsRoute
   PoliciesRoute: typeof PoliciesRoute
   SecretsRoute: typeof SecretsRoute
   ToolsRoute: typeof ToolsRoute
@@ -158,6 +171,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof PoliciesRouteImport
       parentRoute: typeof rootRouteImport
     }
+    '/oauth-apps': {
+      id: '/oauth-apps'
+      path: '/oauth-apps'
+      fullPath: '/oauth-apps'
+      preLoaderRoute: typeof OauthAppsRouteImport
+      parentRoute: typeof rootRouteImport
+    }
     '/': {
       id: '/'
       path: '/'
@@ -198,6 +218,7 @@ declare module '@tanstack/react-router' {
 
 const rootRouteChildren: RootRouteChildren = {
   IndexRoute: IndexRoute,
+  OauthAppsRoute: OauthAppsRoute,
   PoliciesRoute: PoliciesRoute,
   SecretsRoute: SecretsRoute,
   ToolsRoute: ToolsRoute,
diff --git a/packages/app/src/routes/oauth-apps.tsx b/packages/app/src/routes/oauth-apps.tsx
new file mode 100644
index 000000000..926f4d5fb
--- /dev/null
+++ b/packages/app/src/routes/oauth-apps.tsx
@@ -0,0 +1,6 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { OAuthAppsPage } from "@executor-js/react/pages/oauth-apps";
+
+export const Route = createFileRoute("/oauth-apps")({
+  component: OAuthAppsPage,
+});
diff --git a/packages/app/src/web/shell.tsx b/packages/app/src/web/shell.tsx
index b508f10d7..f5909a18e 100644
--- a/packages/app/src/web/shell.tsx
+++ b/packages/app/src/web/shell.tsx
@@ -338,6 +338,7 @@ function SidebarContent(props: {
 }) {
   const isHome = props.pathname === "/";
   const isSecrets = props.pathname === "/secrets";
+  const isOAuthApps = props.pathname === "/oauth-apps";
   const isPolicies = props.pathname === "/policies";
 
   return (
@@ -357,8 +358,14 @@ function SidebarContent(props: {
       )}
 
       <nav className="flex flex-1 flex-col overflow-y-auto p-2">
-        <NavItem to="/" label="Sources" active={isHome} onNavigate={props.onNavigate} />
+        <NavItem to="/" label="Integrations" active={isHome} onNavigate={props.onNavigate} />
         <NavItem to="/secrets" label="Secrets" active={isSecrets} onNavigate={props.onNavigate} />
+        <NavItem
+          to="/oauth-apps"
+          label="OAuth Connections"
+          active={isOAuthApps}
+          onNavigate={props.onNavigate}
+        />
         <NavItem
           to="/policies"
           label="Policies"
diff --git a/packages/plugins/graphql/src/react/AddGraphqlSource.tsx b/packages/plugins/graphql/src/react/AddGraphqlSource.tsx
index 74affa990..c3890f0d1 100644
--- a/packages/plugins/graphql/src/react/AddGraphqlSource.tsx
+++ b/packages/plugins/graphql/src/react/AddGraphqlSource.tsx
@@ -131,7 +131,6 @@ export default function AddGraphqlSource(props: {
     }
     const registeredSlug = integrationExit.value.slug;
 
-    setAdding(false);
     props.onComplete(String(registeredSlug));
   };
 
@@ -150,7 +149,7 @@ export default function AddGraphqlSource(props: {
         />
       </section>
 
-      {slugAlreadyExists && (
+      {slugAlreadyExists && !adding && (
         <div className="rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2">
           <p className="text-[12px] text-destructive">
             An integration named &quot;{resolvedSlug}&quot; already exists. To add more
diff --git a/packages/plugins/mcp/src/react/AddMcpSource.tsx b/packages/plugins/mcp/src/react/AddMcpSource.tsx
index 3035b3e63..588359016 100644
--- a/packages/plugins/mcp/src/react/AddMcpSource.tsx
+++ b/packages/plugins/mcp/src/react/AddMcpSource.tsx
@@ -494,7 +494,7 @@ export default function AddMcpSource(props: {
             </div>
           )}
 
-          {remoteSlugExists && (
+          {remoteSlugExists && !isAdding && (
             <div className="rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2">
               <p className="text-[12px] text-destructive">
                 An integration named &quot;{remoteSlug}&quot; already exists. To add more
@@ -586,7 +586,7 @@ export default function AddMcpSource(props: {
             </div>
           )}
 
-          {stdioSlugExists && (
+          {stdioSlugExists && !stdioAdding && (
             <div className="rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2">
               <p className="text-[12px] text-destructive">
                 An integration named &quot;{stdioSlug}&quot; already exists. To add more
diff --git a/packages/plugins/mcp/src/sdk/describe-auth-methods.test.ts b/packages/plugins/mcp/src/sdk/describe-auth-methods.test.ts
index db429af4a..0a5d4c21d 100644
--- a/packages/plugins/mcp/src/sdk/describe-auth-methods.test.ts
+++ b/packages/plugins/mcp/src/sdk/describe-auth-methods.test.ts
@@ -77,7 +77,7 @@ describe("describeMcpAuthMethods", () => {
     ]);
   });
 
-  it("returns [] for an open (none) remote server", () => {
+  it("projects an open (none) remote server to a no-auth method", () => {
     const methods = describeMcpAuthMethods(
       recordWith({
         transport: "remote",
@@ -85,7 +85,31 @@ describe("describeMcpAuthMethods", () => {
         auth: { kind: "none" },
       }),
     );
-    expect(methods).toEqual([]);
+    expect(methods).toEqual([
+      {
+        id: "none",
+        label: "No authentication",
+        kind: "none",
+        template: "none",
+      },
+    ]);
+  });
+
+  it("treats legacy remote configs with no auth field as open/no-auth", () => {
+    const methods = describeMcpAuthMethods(
+      recordWith({
+        transport: "remote",
+        endpoint: "https://x.example/mcp",
+      }),
+    );
+    expect(methods).toEqual([
+      {
+        id: "none",
+        label: "No authentication",
+        kind: "none",
+        template: "none",
+      },
+    ]);
   });
 
   it("returns [] for a stdio transport", () => {
diff --git a/packages/plugins/mcp/src/sdk/plugin.ts b/packages/plugins/mcp/src/sdk/plugin.ts
index fec2789fa..8d2f3fa0a 100644
--- a/packages/plugins/mcp/src/sdk/plugin.ts
+++ b/packages/plugins/mcp/src/sdk/plugin.ts
@@ -397,7 +397,8 @@ const buildConnectorInput = (
 // plugin-agnostic `AuthMethodDescriptor[]`. Pure and tolerant of a malformed or
 // foreign config blob (returns `[]`). Exported for tests.
 //
-//   stdio / open (`none`) → []          (no auth method to pick)
+//   open (`none`)        → one none method carrying no credential inputs
+//   stdio                → []          (no remote connection to configure)
 //   header               → one apikey method carrying the header placement
 //   oauth2               → one oauth method carrying the MCP endpoint to probe
 //                          (`discoveryUrl`); endpoints are discovered live at
@@ -414,6 +415,16 @@ export const describeMcpAuthMethods = (
   if (!config || config.transport === "stdio") return [];
 
   const auth = config.auth;
+  if (auth.kind === "none") {
+    return [
+      {
+        id: "none",
+        label: "No authentication",
+        kind: "none",
+        template: "none",
+      },
+    ];
+  }
   if (auth.kind === "header") {
     return [
       {
diff --git a/packages/plugins/mcp/src/sdk/types.ts b/packages/plugins/mcp/src/sdk/types.ts
index 06f3fd85e..2ee68e0dd 100644
--- a/packages/plugins/mcp/src/sdk/types.ts
+++ b/packages/plugins/mcp/src/sdk/types.ts
@@ -93,8 +93,18 @@ const decodeIntegrationConfig = Schema.decodeUnknownOption(McpIntegrationConfig)
 
 /** Parse an opaque integration `config` blob into a typed MCP config, or null
  *  if it isn't this plugin's shape. */
-export const parseMcpIntegrationConfig = (config: unknown): McpIntegrationConfig | null =>
-  Option.getOrNull(decodeIntegrationConfig(config));
+export const parseMcpIntegrationConfig = (config: unknown): McpIntegrationConfig | null => {
+  if (
+    typeof config === "object" &&
+    config !== null &&
+    "transport" in config &&
+    config.transport === "remote" &&
+    !("auth" in config)
+  ) {
+    return Option.getOrNull(decodeIntegrationConfig({ ...config, auth: { kind: "none" } }));
+  }
+  return Option.getOrNull(decodeIntegrationConfig(config));
+};
 
 // ---------------------------------------------------------------------------
 // Tool annotations — upstream MCP ToolAnnotations we honour (destructiveHint
diff --git a/packages/plugins/openapi/src/react/AddOpenApiSource.tsx b/packages/plugins/openapi/src/react/AddOpenApiSource.tsx
index e42655891..2f4e24f96 100644
--- a/packages/plugins/openapi/src/react/AddOpenApiSource.tsx
+++ b/packages/plugins/openapi/src/react/AddOpenApiSource.tsx
@@ -550,7 +550,6 @@ export default function AddOpenApiSource(props: {
       return;
     }
 
-    setAdding(false);
     props.onComplete(String(integration));
   };
 
@@ -703,7 +702,7 @@ export default function AddOpenApiSource(props: {
         </section>
       )}
 
-      {hasPreviewOrBundle && slugAlreadyExists && (
+      {hasPreviewOrBundle && slugAlreadyExists && !adding && (
         <div className="rounded-lg border border-destructive/30 bg-destructive/5 px-3 py-2">
           <p className="text-[12px] text-destructive">
             An integration named &quot;{resolvedSourceId}&quot; already exists. To add more
diff --git a/packages/react/src/components/accounts-section.tsx b/packages/react/src/components/accounts-section.tsx
index 52976074c..a81948d3a 100644
--- a/packages/react/src/components/accounts-section.tsx
+++ b/packages/react/src/components/accounts-section.tsx
@@ -48,7 +48,7 @@ import {
 // Accounts section — the integration's connections, grouped by owner.
 //
 // Accounts are IMMUTABLE: the per-row menu is Reconnect + Remove only (no
-// rename, no method switch). "+ Add account" opens the create modal. When both
+// rename, no method switch). "+ Add connection" opens the create modal. When both
 // owners have zero accounts, the section collapses to a single empty CTA.
 // ---------------------------------------------------------------------------
 
@@ -243,7 +243,7 @@ export function AccountsSection(props: {
   readonly integrationName: string;
   readonly methods: readonly AuthMethod[];
   readonly accountHandoff?: IntegrationAccountHandoff | null;
-  /** When provided, Add-account shows a "+ Custom method" row. The plugin binds
+  /** When provided, Add connection shows a "+ Custom method" row. The plugin binds
    *  this to its own configure mutation. Omitted for plugins with fixed auth. */
   readonly createCustomMethod?: CreateCustomMethod;
 }) {
@@ -298,7 +298,7 @@ export function AccountsSection(props: {
     <section className="space-y-3">
       <div className="flex items-center justify-between">
         <h3 className="text-xs font-medium uppercase tracking-wide text-muted-foreground">
-          Accounts
+          Connections
         </h3>
         <Button
           type="button"
@@ -307,7 +307,7 @@ export function AccountsSection(props: {
           onClick={() => setAdding(true)}
           disabled={methods.length === 0}
         >
-          Add account
+          Add connection
         </Button>
       </div>
 
@@ -320,7 +320,7 @@ export function AccountsSection(props: {
         <div className="rounded-lg border border-dashed border-border/60 px-6 py-8 text-center">
           <p className="text-sm font-medium text-foreground">No connections yet</p>
           <p className="mt-1 text-sm text-muted-foreground">
-            This integration is added but has no credentials — so it exposes no tools.
+            Add a connection to make this integration's tools available.
           </p>
           <Button
             type="button"
diff --git a/packages/react/src/components/add-account-modal.test.ts b/packages/react/src/components/add-account-modal.test.ts
index d4f02cc1e..72577a914 100644
--- a/packages/react/src/components/add-account-modal.test.ts
+++ b/packages/react/src/components/add-account-modal.test.ts
@@ -103,6 +103,18 @@ describe("mergeCustomMethods (in-session custom method append)", () => {
 });
 
 describe("createCredentialPayloadOrigin", () => {
+  it("creates an empty values payload for no-auth connection methods", () => {
+    expect(
+      createCredentialPayloadOrigin({
+        origin: "paste",
+        inputs: [],
+        values: {},
+        onePasswordItemId: "",
+        singleInput: true,
+      }),
+    ).toEqual({ values: {} });
+  });
+
   it("keeps pasted credential values trimmed and keyed by input variable", () => {
     expect(
       createCredentialPayloadOrigin({
diff --git a/packages/react/src/components/add-account-modal.tsx b/packages/react/src/components/add-account-modal.tsx
index 9c5646cdb..99787f960 100644
--- a/packages/react/src/components/add-account-modal.tsx
+++ b/packages/react/src/components/add-account-modal.tsx
@@ -96,7 +96,7 @@ export function createCredentialPayloadOrigin(args: {
   readonly onePasswordItemId: string;
   readonly singleInput: boolean;
 }): CredentialPayloadOrigin | null {
-  if (args.inputs.length === 0) return null;
+  if (args.inputs.length === 0) return { values: {} };
   if (args.origin === "onepassword") {
     const id = args.onePasswordItemId.trim();
     if (!args.singleInput || id.length === 0) return null;
@@ -595,12 +595,13 @@ export function AddAccountModal(props: {
     setDcrFailed(false);
   }, [initialState, allMethods, defaultOwner, scopeOptions]);
   const isOAuth = method?.kind === "oauth";
+  const isNoAuth = method?.kind === "none";
   // The distinct credential inputs the selected method needs — one per variable
   // across its placements. A single-input method yields one field (`token`); a
   // multi-input method (e.g. Datadog) yields one per key. Two placements sharing
   // a variable collapse to one input.
   const credentialInputs = useMemo<readonly CredentialInput[]>(() => {
-    if (!method || method.kind === "oauth") return [];
+    if (!method || method.kind === "oauth" || method.kind === "none") return [];
     const byVar = new Map<string, string[]>();
     for (const placement of method.placements) {
       const variable = placement.variable ?? "token";
@@ -750,10 +751,10 @@ export function AddAccountModal(props: {
     });
     if (Exit.isFailure(exit)) {
       setSubmitting(false);
-      toast.error(messageFromExit(exit, "Failed to add account"));
+      toast.error(messageFromExit(exit, "Failed to add connection"));
       return;
     }
-    toast.success("Account added");
+    toast.success("Connection added");
     close();
   };
 
@@ -791,14 +792,14 @@ export function AddAccountModal(props: {
         toast.error(messageFromExit(exit, "Failed to connect"));
         return;
       }
-      toast.success("Account added");
+      toast.success("Connection added");
       close();
       return;
     }
     void oauthPopup.start({
       payload,
       onSuccess: () => {
-        toast.success("Account added");
+        toast.success("Connection added");
         close();
       },
     });
@@ -856,7 +857,7 @@ export function AddAccountModal(props: {
               identityLabel,
             },
             onSuccess: () => {
-              toast.success("Account added");
+              toast.success("Connection added");
               close();
             },
           });
@@ -900,11 +901,11 @@ export function AddAccountModal(props: {
       >
         <DialogContent className="max-h-[85vh] overflow-y-auto sm:max-w-xl">
           <DialogHeader>
-            <DialogTitle>Add account · {integrationName}</DialogTitle>
+            <DialogTitle>Add connection · {integrationName}</DialogTitle>
             <DialogDescription>
               {ownerDisplay.showOwnerLabels
-                ? "A connection is one credential for this integration, owned by you or the workspace."
-                : "A connection is one credential for this integration."}
+                ? "A connection is a saved way to use this integration, owned by you or the workspace."
+                : "A connection is a saved way to use this integration."}
             </DialogDescription>
           </DialogHeader>
 
@@ -941,9 +942,11 @@ export function AddAccountModal(props: {
                       <span className="block text-xs text-muted-foreground">
                         {m.kind === "oauth"
                           ? "OAuth2 flow"
-                          : m.source === "custom"
-                            ? "Custom method on this integration"
-                            : "Declared by the integration"}
+                          : m.kind === "none"
+                            ? "No credential required"
+                            : m.source === "custom"
+                              ? "Custom method on this integration"
+                              : "Declared by the integration"}
                       </span>
                       {m.placements.length > 0 && (
                         <span className="mt-1.5 flex flex-wrap gap-x-3.5 gap-y-1">
@@ -970,164 +973,166 @@ export function AddAccountModal(props: {
             </div>
 
             {/* 3. credential / OAuth app */}
-            <div className="space-y-2">
-              <StepHeader index={3} label={isOAuth ? "OAuth app" : "Credential"} />
+            {!isNoAuth && (
+              <div className="space-y-2">
+                <StepHeader index={3} label={isOAuth ? "OAuth app" : "Credential"} />
 
-              {isOAuth && method ? (
-                dcrActive ? (
-                  // Transparent DCR: no picker. We register an app for you and run
-                  // the OAuth flow with a single Connect click.
-                  <div className="space-y-2 rounded-lg border border-ring/40 bg-accent/30 px-3 py-3">
-                    <p className="text-sm font-medium">No app to choose</p>
-                    <p className="text-xs text-muted-foreground">
-                      {dcrConnecting
-                        ? `Connecting to ${integrationName}…`
-                        : `${integrationName} supports automatic setup. We register an app for you and sign you in — no client ID or app to pick.`}
-                    </p>
-                  </div>
-                ) : oauthLoading ? (
-                  <p className="text-xs text-muted-foreground">Loading OAuth apps…</p>
-                ) : (
-                  <div className="space-y-3">
-                    {/* No registered app matched the integration's endpoint:
+                {isOAuth && method ? (
+                  dcrActive ? (
+                    // Transparent DCR: no picker. We register an app for you and run
+                    // the OAuth flow with a single Connect click.
+                    <div className="space-y-2 rounded-lg border border-ring/40 bg-accent/30 px-3 py-3">
+                      <p className="text-sm font-medium">No app to choose</p>
+                      <p className="text-xs text-muted-foreground">
+                        {dcrConnecting
+                          ? `Connecting to ${integrationName}…`
+                          : `${integrationName} supports automatic setup. We register an app for you and sign you in — no client ID or app to pick.`}
+                      </p>
+                    </div>
+                  ) : oauthLoading ? (
+                    <p className="text-xs text-muted-foreground">Loading OAuth apps…</p>
+                  ) : (
+                    <div className="space-y-3">
+                      {/* No registered app matched the integration's endpoint:
                       empty state + a prominent register CTA, and an opt-in
                       collapsed "use a different registered app" escape hatch. */}
-                    {oauthDisplayRegisterCTA && selectedApp !== REGISTER_NEW && (
-                      <div className="space-y-3 rounded-lg border border-border/60 bg-muted/20 px-3 py-3">
-                        <p className="text-sm font-medium">No app for {integrationName} yet</p>
-                        <p className="text-xs text-muted-foreground">
-                          None of your registered apps target this integration's OAuth endpoint.
-                          Register one to connect.
-                        </p>
-                        <Button type="button" onClick={() => setPickedApp(REGISTER_NEW)}>
-                          Register an app for {integrationName}
-                        </Button>
-                        {oauthOtherApps.length > 0 &&
-                          (showOtherApps ? (
-                            <RadioGroup
-                              value={selectedApp}
-                              onValueChange={setPickedApp}
-                              className="gap-2 pt-1"
-                            >
-                              {oauthOtherApps.map((app: OAuthClientOption) => (
-                                <Label
-                                  key={String(app.slug)}
-                                  htmlFor={`other-app-${app.slug}`}
-                                  className="flex cursor-pointer items-center gap-3 rounded-lg border border-border/60 bg-background/40 px-3 py-2.5 font-normal has-[:checked]:border-ring has-[:checked]:bg-accent/40"
-                                >
-                                  <RadioGroupItem
-                                    id={`other-app-${app.slug}`}
-                                    value={String(app.slug)}
-                                  />
-                                  <span className="min-w-0 flex-1">
-                                    <span className="block text-sm font-medium">
-                                      {clientDisplayName(String(app.slug))}
-                                    </span>
-                                    <span className="block truncate text-xs text-muted-foreground">
-                                      {clientHost(app.tokenUrl)} ·{" "}
-                                      {app.grant === "client_credentials"
-                                        ? "app-to-app"
-                                        : "you'll sign in"}
+                      {oauthDisplayRegisterCTA && selectedApp !== REGISTER_NEW && (
+                        <div className="space-y-3 rounded-lg border border-border/60 bg-muted/20 px-3 py-3">
+                          <p className="text-sm font-medium">No app for {integrationName} yet</p>
+                          <p className="text-xs text-muted-foreground">
+                            None of your registered apps target this integration's OAuth endpoint.
+                            Register one to connect.
+                          </p>
+                          <Button type="button" onClick={() => setPickedApp(REGISTER_NEW)}>
+                            Register an app for {integrationName}
+                          </Button>
+                          {oauthOtherApps.length > 0 &&
+                            (showOtherApps ? (
+                              <RadioGroup
+                                value={selectedApp}
+                                onValueChange={setPickedApp}
+                                className="gap-2 pt-1"
+                              >
+                                {oauthOtherApps.map((app: OAuthClientOption) => (
+                                  <Label
+                                    key={String(app.slug)}
+                                    htmlFor={`other-app-${app.slug}`}
+                                    className="flex cursor-pointer items-center gap-3 rounded-lg border border-border/60 bg-background/40 px-3 py-2.5 font-normal has-[:checked]:border-ring has-[:checked]:bg-accent/40"
+                                  >
+                                    <RadioGroupItem
+                                      id={`other-app-${app.slug}`}
+                                      value={String(app.slug)}
+                                    />
+                                    <span className="min-w-0 flex-1">
+                                      <span className="block text-sm font-medium">
+                                        {clientDisplayName(String(app.slug))}
+                                      </span>
+                                      <span className="block truncate text-xs text-muted-foreground">
+                                        {clientHost(app.tokenUrl)} ·{" "}
+                                        {app.grant === "client_credentials"
+                                          ? "app-to-app"
+                                          : "you'll sign in"}
+                                      </span>
                                     </span>
-                                  </span>
-                                  {ownerDisplay.showOwnerLabels ? (
-                                    <Badge variant="outline">{ownerLabel(app.owner)}</Badge>
-                                  ) : null}
-                                </Label>
-                              ))}
-                            </RadioGroup>
-                          ) : (
-                            <Button
-                              type="button"
-                              variant="ghost"
-                              size="sm"
-                              onClick={() => setShowOtherApps(true)}
-                              className="h-auto px-0 text-xs text-muted-foreground hover:bg-transparent hover:text-foreground"
+                                    {ownerDisplay.showOwnerLabels ? (
+                                      <Badge variant="outline">{ownerLabel(app.owner)}</Badge>
+                                    ) : null}
+                                  </Label>
+                                ))}
+                              </RadioGroup>
+                            ) : (
+                              <Button
+                                type="button"
+                                variant="ghost"
+                                size="sm"
+                                onClick={() => setShowOtherApps(true)}
+                                className="h-auto px-0 text-xs text-muted-foreground hover:bg-transparent hover:text-foreground"
+                              >
+                                Use a different registered app
+                              </Button>
+                            ))}
+                        </div>
+                      )}
+
+                      {oauthApps.length > 0 && (
+                        <RadioGroup
+                          value={selectedApp}
+                          onValueChange={setPickedApp}
+                          className="gap-2"
+                        >
+                          {oauthApps.map((app: OAuthClientOption) => (
+                            <Label
+                              key={String(app.slug)}
+                              htmlFor={`app-${app.slug}`}
+                              className="flex cursor-pointer items-center gap-3 rounded-lg border border-border/60 bg-muted/30 px-3 py-2.5 font-normal has-[:checked]:border-ring has-[:checked]:bg-accent/40"
                             >
-                              Use a different registered app
-                            </Button>
+                              <RadioGroupItem id={`app-${app.slug}`} value={String(app.slug)} />
+                              <span className="min-w-0 flex-1">
+                                <span className="block text-sm font-medium">
+                                  {clientDisplayName(String(app.slug))}
+                                </span>
+                                <span className="block truncate text-xs text-muted-foreground">
+                                  {clientHost(app.tokenUrl)} ·{" "}
+                                  {app.grant === "client_credentials"
+                                    ? "app-to-app"
+                                    : "you'll sign in"}
+                                </span>
+                              </span>
+                              {ownerDisplay.showOwnerLabels ? (
+                                <Badge variant="outline">{ownerLabel(app.owner)}</Badge>
+                              ) : null}
+                            </Label>
                           ))}
-                      </div>
-                    )}
-
-                    {oauthApps.length > 0 && (
-                      <RadioGroup
-                        value={selectedApp}
-                        onValueChange={setPickedApp}
-                        className="gap-2"
-                      >
-                        {oauthApps.map((app: OAuthClientOption) => (
                           <Label
-                            key={String(app.slug)}
-                            htmlFor={`app-${app.slug}`}
-                            className="flex cursor-pointer items-center gap-3 rounded-lg border border-border/60 bg-muted/30 px-3 py-2.5 font-normal has-[:checked]:border-ring has-[:checked]:bg-accent/40"
+                            htmlFor={`app-${REGISTER_NEW}`}
+                            className="flex cursor-pointer items-center gap-3 rounded-lg border border-dashed border-border/60 px-3 py-2.5 text-sm font-normal text-muted-foreground has-[:checked]:border-ring has-[:checked]:text-foreground"
                           >
-                            <RadioGroupItem id={`app-${app.slug}`} value={String(app.slug)} />
-                            <span className="min-w-0 flex-1">
-                              <span className="block text-sm font-medium">
-                                {clientDisplayName(String(app.slug))}
-                              </span>
-                              <span className="block truncate text-xs text-muted-foreground">
-                                {clientHost(app.tokenUrl)} ·{" "}
-                                {app.grant === "client_credentials"
-                                  ? "app-to-app"
-                                  : "you'll sign in"}
-                              </span>
-                            </span>
-                            {ownerDisplay.showOwnerLabels ? (
-                              <Badge variant="outline">{ownerLabel(app.owner)}</Badge>
-                            ) : null}
+                            <RadioGroupItem id={`app-${REGISTER_NEW}`} value={REGISTER_NEW} />
+                            Register a new app
                           </Label>
-                        ))}
-                        <Label
-                          htmlFor={`app-${REGISTER_NEW}`}
-                          className="flex cursor-pointer items-center gap-3 rounded-lg border border-dashed border-border/60 px-3 py-2.5 text-sm font-normal text-muted-foreground has-[:checked]:border-ring has-[:checked]:text-foreground"
-                        >
-                          <RadioGroupItem id={`app-${REGISTER_NEW}`} value={REGISTER_NEW} />
-                          Register a new app
-                        </Label>
-                      </RadioGroup>
-                    )}
+                        </RadioGroup>
+                      )}
 
-                    {selectedApp === REGISTER_NEW && (
-                      <OAuthClientForm
-                        integrationName={integrationName}
-                        existingSlugs={[...oauthApps, ...oauthOtherApps].map(
-                          (app: OAuthClientOption) => String(app.slug),
-                        )}
-                        prefill={{
-                          authorizationUrl: method.oauth?.authorizationUrl,
-                          tokenUrl: method.oauth?.tokenUrl,
-                          scopes: method.oauth?.scopes,
-                          registrationEndpoint: method.oauth?.registrationEndpoint,
-                        }}
-                        onCreated={(result: {
-                          readonly owner: Owner;
-                          readonly slug: OAuthClientSlug;
-                        }) => setPickedApp(String(result.slug))}
-                      />
-                    )}
-                  </div>
-                )
-              ) : (
-                <CredentialValueFields
-                  inputs={credentialInputs}
-                  singleInput={singleInput}
-                  values={values}
-                  onValuesChange={setValues}
-                  origin={credentialOrigin}
-                  onOriginChange={(next) => {
-                    setCredentialOrigin(next);
-                    if (next === "paste") setOnePasswordItemId("");
-                  }}
-                  onePasswordItemId={onePasswordItemId}
-                  onOnePasswordItemIdChange={setOnePasswordItemId}
-                />
-              )}
-              {isOAuth && oauthPopup.error ? (
-                <p className="text-xs text-destructive">{oauthPopup.error}</p>
-              ) : null}
-            </div>
+                      {selectedApp === REGISTER_NEW && (
+                        <OAuthClientForm
+                          integrationName={integrationName}
+                          existingSlugs={[...oauthApps, ...oauthOtherApps].map(
+                            (app: OAuthClientOption) => String(app.slug),
+                          )}
+                          prefill={{
+                            authorizationUrl: method.oauth?.authorizationUrl,
+                            tokenUrl: method.oauth?.tokenUrl,
+                            scopes: method.oauth?.scopes,
+                            registrationEndpoint: method.oauth?.registrationEndpoint,
+                          }}
+                          onCreated={(result: {
+                            readonly owner: Owner;
+                            readonly slug: OAuthClientSlug;
+                          }) => setPickedApp(String(result.slug))}
+                        />
+                      )}
+                    </div>
+                  )
+                ) : (
+                  <CredentialValueFields
+                    inputs={credentialInputs}
+                    singleInput={singleInput}
+                    values={values}
+                    onValuesChange={setValues}
+                    origin={credentialOrigin}
+                    onOriginChange={(next) => {
+                      setCredentialOrigin(next);
+                      if (next === "paste") setOnePasswordItemId("");
+                    }}
+                    onePasswordItemId={onePasswordItemId}
+                    onOnePasswordItemIdChange={setOnePasswordItemId}
+                  />
+                )}
+                {isOAuth && oauthPopup.error ? (
+                  <p className="text-xs text-destructive">{oauthPopup.error}</p>
+                ) : null}
+              </div>
+            )}
 
             {/* 4. connection saved-to. Hidden while registering a new OAuth app
               (the connection, and where it's saved, only exists once you
@@ -1163,7 +1168,7 @@ export function AddAccountModal(props: {
                 probe → register → start;
               - registering a BYO app: the form owns its own submit, no footer;
               - picked BYO OAuth app: Connect with OAuth / Connect (client creds);
-              - credential method: Add account. */}
+              - credential/no-auth method: Add connection. */}
             {dcrActive ? (
               <Button
                 type="button"
@@ -1186,7 +1191,7 @@ export function AddAccountModal(props: {
               </Button>
             ) : (
               <Button type="button" onClick={() => void handleSubmit()} disabled={!canSubmit}>
-                {submitting ? "Adding…" : "Add account"}
+                {submitting ? "Adding…" : "Add connection"}
               </Button>
             )}
           </DialogFooter>
diff --git a/packages/react/src/lib/auth-placements.test.ts b/packages/react/src/lib/auth-placements.test.ts
index 70ec19ce2..2a3712560 100644
--- a/packages/react/src/lib/auth-placements.test.ts
+++ b/packages/react/src/lib/auth-placements.test.ts
@@ -77,13 +77,20 @@ describe("authMethodsFromDescriptors", () => {
     ]);
   });
 
-  it("filters out `none` methods (open servers have no credential)", () => {
+  it("keeps `none` methods as no-input connection methods", () => {
     const methods = authMethodsFromDescriptors([
       { id: "none", label: "No auth", kind: "none", template: "none" },
       { id: "oauth2", label: "OAuth", kind: "oauth", template: "oauth2" },
     ]);
-    expect(methods).toHaveLength(1);
-    expect(methods[0]?.id).toBe("oauth2");
+    expect(methods).toHaveLength(2);
+    expect(methods[0]).toMatchObject({
+      id: "none",
+      label: "No auth",
+      kind: "none",
+      placements: [],
+    });
+    expect(String(methods[0]?.template)).toBe("none");
+    expect(methods[1]?.id).toBe("oauth2");
   });
 
   it("returns an empty array for no descriptors", () => {
diff --git a/packages/react/src/lib/auth-placements.tsx b/packages/react/src/lib/auth-placements.tsx
index b9fc1a5bb..93732a4d9 100644
--- a/packages/react/src/lib/auth-placements.tsx
+++ b/packages/react/src/lib/auth-placements.tsx
@@ -37,11 +37,12 @@ export interface Placement {
 export const emptyPlacement = (): Placement => ({ carrier: "header", name: "", prefix: "" });
 
 /** What an auth method is, presentationally. `kind` drives the credential UI:
- *  `oauth` shows a Connect button; everything else fills one secret across all
- *  `placements`. `source` distinguishes integration-declared ("spec") methods
- *  from user-defined ("custom") ones. `template` is the auth-template slug the
+ *  `oauth` shows a Connect button, `none` creates a connection with no
+ *  credential inputs, and apikey/custom fill secrets across `placements`.
+ *  `source` distinguishes integration-declared ("spec") methods from
+ *  user-defined ("custom") ones. `template` is the auth-template slug the
  *  method applies a connection through. */
-export type AuthMethodKind = "oauth" | "apikey" | "custom";
+export type AuthMethodKind = "oauth" | "apikey" | "custom" | "none";
 
 /** Provider OAuth endpoints/scopes an `oauth` method declares, used to pre-fill
  *  the client-registration form so the user only pastes their client id/secret.
@@ -115,19 +116,27 @@ export function PlacementLine(props: { readonly placement: Placement; readonly m
 // the owning plugin's opaque config). This converts that wire shape into the
 // presentational `AuthMethod[]` the hub renders — the single, plugin-agnostic
 // home for the mapping so both the detail page and the add-account modal share
-// it. `none` methods (open servers) are filtered out: they carry no credential
-// and don't belong in the auth-method picker.
+// it. `none` methods are kept: they create a named connection without
+// credential inputs.
 // ---------------------------------------------------------------------------
 
 const DEFAULT_PLACEMENTS: readonly Placement[] = [
   { carrier: "header", name: "Authorization", prefix: "" },
 ];
 
-/** Convert one catalog descriptor into a client `AuthMethod`, or `null` for
- *  `kind: "none"` (which is dropped — open servers have no credential method). */
-function authMethodFromDescriptor(descriptor: AuthMethodDescriptor): AuthMethod | null {
-  if (descriptor.kind === "none") return null;
+/** Convert one catalog descriptor into a client `AuthMethod`. */
+function authMethodFromDescriptor(descriptor: AuthMethodDescriptor): AuthMethod {
   const template = AuthTemplateSlug.make(descriptor.template);
+  if (descriptor.kind === "none") {
+    return {
+      id: descriptor.id,
+      label: descriptor.label,
+      kind: "none",
+      source: "spec",
+      template,
+      placements: [],
+    };
+  }
   if (descriptor.kind === "oauth") {
     const oauth = descriptor.oauth;
     return {
@@ -172,14 +181,9 @@ function authMethodFromDescriptor(descriptor: AuthMethodDescriptor): AuthMethod
 }
 
 /** Convert an integration's declared catalog descriptors into the client
- *  `AuthMethod[]` the hub renders. `none` methods are dropped. */
+ *  `AuthMethod[]` the hub renders. */
 export function authMethodsFromDescriptors(
   descriptors: readonly AuthMethodDescriptor[],
 ): readonly AuthMethod[] {
-  const methods: AuthMethod[] = [];
-  for (const descriptor of descriptors) {
-    const method = authMethodFromDescriptor(descriptor);
-    if (method !== null) methods.push(method);
-  }
-  return methods;
+  return descriptors.map(authMethodFromDescriptor);
 }
diff --git a/packages/react/src/pages/integration-detail.tsx b/packages/react/src/pages/integration-detail.tsx
index 9e9a78a10..bdcd7757d 100644
--- a/packages/react/src/pages/integration-detail.tsx
+++ b/packages/react/src/pages/integration-detail.tsx
@@ -247,28 +247,16 @@ export function IntegrationDetailPage(props: { namespace: string }) {
     return authMethodsFromDescriptors(integrationData.authMethods);
   }, [integrationData]);
 
-  // Connection-inference fallback — ONLY used when the plugin declares nothing.
-  // Keeps legacy apikey integrations working: infer one method per distinct
-  // `template` already in use by this integration's connections, defaulting to a
-  // single API-key method so adding an account works even with zero connections.
+  // Connection-inference fallback — only infer from real existing connections.
+  // Do not invent an API-key method from an empty catalog response: open/no-auth
+  // integrations intentionally have no credential method, and showing an API key
+  // there misrepresents the integration.
   const inferredFallbackMethods = useMemo<readonly AuthMethod[]>(() => {
     const connections = AsyncResult.isSuccess(connectionsResult) ? connectionsResult.value : [];
     const templates = new Set<string>();
     for (const connection of connections as readonly Connection[]) {
       if (connection.integration === slug) templates.add(String(connection.template));
     }
-    if (templates.size === 0) {
-      return [
-        {
-          id: "default",
-          label: "API key",
-          kind: "apikey",
-          source: "spec",
-          template: AuthTemplateSlug.make("default"),
-          placements: [{ carrier: "header", name: "Authorization", prefix: "" }],
-        },
-      ];
-    }
     return Array.from(templates).map((template: string): AuthMethod => {
       const isOAuth = template === "oauth2" || template === "oauth";
       return {