@@ -202,6 +202,7 @@ Dependent package
 ============================================================================================================  ==============
 `apache-airflow-providers-common-sql <https://airflow.apache.org/docs/apache-airflow-providers-common-sql>`_  ``common.sql``
 `apache-airflow-providers-git <https://airflow.apache.org/docs/apache-airflow-providers-git>`_                ``git``
+`apache-airflow-providers-modal <https://airflow.apache.org/docs/apache-airflow-providers-modal>`_            ``modal``
 ============================================================================================================  ==============
 
 Optional dependencies
@@ -224,7 +225,7 @@ Extra            Dependencies
 ``openai``       ``pydantic-ai-slim[openai]>=2.33.0``, ``openai>=2.47.0``
 ``typesafe``     ``typesafe-sdk>=0.6.0``
 ``mcp``          ``pydantic-ai-slim[mcp]>=2.33.0``
-``modal``        ``modal>=1.5.2``
+``modal``        ``apache-airflow-providers-modal``, ``modal>=1.5.2``
 ``opensandbox``  ``opensandbox>=1.1.0``
 ``code-mode``    ``pydantic-ai-harness[codemode]>=0.3.0``
 ``shields``      ``pydantic-ai-shields>=0.3.4``
 
@@ -73,6 +73,9 @@ The provider runs on Airflow 2.11, but some features need a newer Airflow versio
      - Needs
    * - The ``skills`` and ``git`` extras (``apache-airflow-providers-git`` needs Airflow 3)
      - Airflow 3.0
+   * - The ``modal`` extra and the Modal sandbox backend (``apache-airflow-providers-modal``
+       needs Airflow 3)
+     - Airflow 3.0
    * - :doc:`Approval gates <approval_gates>` and :doc:`HITL review <hitl_review>`
      - Airflow 3.1
    * - The **Model** field in the connection form; on older Airflow versions put the model in
@@ -104,7 +107,7 @@ On Airflow 2.11 the operators, decorators, hooks and toolsets run as they do on
   ``apache-airflow-providers-common-sql`` to releases older than this provider needs.
   Installing Airflow 2.11.0 without its constraints can also pull in a ``universal-pathlib``
   0.3 release, which Airflow 2's ``ObjectStoragePath`` rejects; 2.11.1 and later cap it.
-  Leave out the ``skills`` and ``git`` extras: they need Airflow 3, and without
+  Leave out the ``skills``, ``git`` and ``modal`` extras: they need Airflow 3, and without
   constraints ``pip`` upgrades Airflow to satisfy them.
 * Python 3.10 to 3.12: the provider needs 3.10 or later, and Airflow 2.11 supports up to 3.12.
 
 
@@ -34,11 +34,19 @@ provider, **this is the managed one to use in production**, and with
 :ref:`OpenSandbox <sandbox-backend-opensandbox>` one of the two that run on
 Kubernetes: nothing has to be installed on the worker, model-written code never
 executes on the worker host, and Modal reclaims a sandbox at its own lifetime
-whether or not the worker survives. It needs the ``modal`` extra and ambient
-credentials, as under :ref:`Quick start <sandbox-quick-start>`.
+whether or not the worker survives. It needs the ``modal`` extra and Modal
+credentials, from a ``modal`` connection or the worker environment, as under
+:ref:`Quick start <sandbox-quick-start>`.
 
 Constructor parameters:
 
+- ``modal_conn_id``: ``modal`` connection the token and, optionally, the Modal
+  ``environment`` come from. Default ``"modal_default"``; ``None`` uses the worker's
+  credentials without looking for a connection. How a missing or partial connection
+  resolves is on the :ref:`Modal connection page <howto/connection:modal>`. A credential
+  problem fails the task, except in the toolset's own teardown, which logs it so a
+  finished run is not failed. The connection type comes from the Modal provider, which
+  the ``modal`` extra installs and which needs Airflow 3.
 - ``image``: Registry tag for the sandbox image, or a prepared ``modal.Image``
   carrying pre-installed packages. Default ``"python:3.12-slim"``.
 - ``app_name``: Modal app the sandboxes are created under. Default
 
@@ -137,8 +137,9 @@ Credentials
 ``SandboxSpec.env`` is the only way in. Airflow never populates it: no connection,
 variable or worker environment variable reaches a sandbox unless you name it
 there, and the credential that *provisions* the sandbox never enters it either.
-Modal's token stays on the worker and is used by the client, so code running
-inside cannot call Modal as you or create further sandboxes.
+Modal's token, whether it comes from the ``modal`` connection or the worker
+environment, stays in the task and is used by the client, so code running inside
+cannot call Modal as you or create further sandboxes.
 
 Before you put a real secret in ``env``, four things are true of it.
 
@@ -266,7 +267,8 @@ A sandbox another task owns
 
 The toolset's own sandbox is provisioned from a spec fixed in the Dag file, on the
 model's first tool call, and destroyed when the run ends. Two things cannot be
-done inside that shape: a credential cannot come from a connection, and a second
+done inside that shape: a credential for the code inside the sandbox
+(``SandboxSpec.env``) cannot come from a connection, and a second
 run against the same agent, which is what :ref:`HITL review <howto:hitl_review>`
 does when a reviewer asks for changes, cannot find the first run's files. A file
 the agent built can leave through ``exports`` (:ref:`sandbox-results`), but only
 
@@ -107,15 +107,19 @@ is the only change between this Dag and production:
     :start-after: [START howto_sandbox_agent_local]
     :end-before: [END howto_sandbox_agent_local]
 
-Install the Modal extra and authenticate as you would for Modal's own CLI. On a
-worker, set ``MODAL_TOKEN_ID`` and ``MODAL_TOKEN_SECRET`` in the environment
-instead; nothing is read until the first sandbox is created, so a Dag file that
-constructs the backend parses without credentials present:
+Install the Modal extra, which also installs the Modal provider, and create a
+``modal`` connection with the Modal token id as its login and the token secret as
+its password. The backend reads ``modal_default`` unless you pass ``modal_conn_id``;
+without that connection it uses the worker's own Modal credentials, as the
+:ref:`Modal connection page <howto/connection:modal>` describes. Nothing is read until
+the first sandbox is created, so a Dag file that constructs the backend parses without
+credentials present:
 
 .. code-block:: bash
 
     pip install 'apache-airflow-providers-common-ai[modal]'
-    modal token new          # writes ~/.modal.toml
+    airflow connections add modal_default --conn-type modal \
+        --conn-login "$MODAL_TOKEN_ID" --conn-password "$MODAL_TOKEN_SECRET"
 
 What it is for, in practice
 ---------------------------
@@ -425,14 +429,13 @@ system tests, ``example_sandbox_toolset_sbx.py`` and
 ``example_sandbox_toolset_modal.py``, run against a real backend and are
 reachable from the System Tests entry in the sidebar.
 
-**Credentials and where it runs.** This route does not end at an
-Airflow connection. Airflow puts none of its context, connections, variables or
-worker environment into the sandbox; only what you pass through
+**Credentials and where it runs.** Airflow puts none of its context, connections,
+variables or worker environment into the sandbox; only what you pass through
 :class:`~airflow.providers.common.ai.sandbox.SandboxSpec` goes in, and the
-credential that provisions the sandbox never enters it. Authorization to the
-backend sits outside Airflow: ``sbx login`` and ``sbx policy init`` on the
-machine for ``sbx``, or ``MODAL_TOKEN_ID`` and ``MODAL_TOKEN_SECRET`` on the
-worker for Modal. Work runs in a per-run microVM on the worker host with
+credential that provisions the sandbox never enters it. For Modal that credential
+is a ``modal`` connection (``modal_conn_id``; see the
+:ref:`Modal connection page <howto/connection:modal>`). For ``sbx`` it sits outside Airflow:
+``sbx login`` on the machine. Work runs in a per-run microVM on the worker host with
 ``sbx``, or off the worker entirely in Modal's infrastructure. Its tool calls
 act as barriers, as they do for the other
 routes that build their own tools; see :ref:`toolset-call-barriers`.
@@ -486,9 +489,9 @@ is the list to read before designing a Dag around an agent with a sandbox.
 - **A file the agent built leaves only through a task**, never through the
   model's context, which is text-only and capped.
   :ref:`Getting a result out <sandbox-results>`.
-- **A credential comes from a connection only when a task provisions the
-  sandbox**; the toolset's own spec is fixed at parse time, and anything injected
-  is readable by the model. :ref:`Credentials <sandbox-credentials>`.
+- **A credential handed to the code inside the sandbox comes from a connection
+  only when a task provisions the sandbox**; the toolset's own spec is fixed at
+  parse time, and anything injected is readable by the model. :ref:`Credentials <sandbox-credentials>`.
 - **Cannot be combined with** ``durable=True``, and with ``enable_hitl_review=True``
   only when the sandbox is task-owned; ``AgentOperator`` raises otherwise.
   :ref:`Lifecycle <sandbox-lifecycle>`.
 
@@ -104,8 +104,11 @@ dependencies = [
 "mcp" = ["pydantic-ai-slim[mcp]>=2.33.0"]
 # Modal-hosted sandboxes for SandboxToolset, the backend to use where the worker host
 # cannot run microVMs -- Kubernetes, most notably. Needs no host-level installation,
-# only Modal credentials.
-"modal" = ["modal>=1.5.2"]
+# only Modal credentials, which the Modal provider's `modal` connection supplies.
+"modal" = [
+    "apache-airflow-providers-modal",
+    "modal>=1.5.2",
+]
 "opensandbox" = ["opensandbox>=1.1.0"]
 # Code mode: collapse tool calls into a single `run_code` tool that the model
 # drives by writing Python, executed in the Monty sandbox (pydantic-monty).
@@ -163,6 +166,7 @@ dev = [
     "apache-airflow-providers-common-compat",
     "apache-airflow-providers-common-sql",
     "apache-airflow-providers-git",
+    "apache-airflow-providers-modal",
     "apache-airflow-providers-standard",
     # Additional devel dependencies (do not remove this line and add extra development dependencies)
     "sqlglot>=30.0.0",
 
@@ -31,6 +31,9 @@
 
 try:
     import modal
+
+    from airflow.providers.modal.exceptions import ModalConnectionError
+    from airflow.providers.modal.hooks.modal import ModalHook
 except ModuleNotFoundError as e:
     from airflow.providers.common.compat.sdk import AirflowOptionalProviderFeatureException
 
@@ -54,6 +57,7 @@
     encode_network_policy,
     is_sandbox_handle,
 )
+from airflow.providers.common.compat.sdk import AirflowNotFoundException
 
 if TYPE_CHECKING:
     from collections.abc import Mapping, Sequence
@@ -106,6 +110,15 @@
 
 EgressEnforcement = Literal["strict", "sni"]
 
+# What reading credentials from the connection can raise before Modal is reached at all: a
+# named connection that does not exist, or one that sets only half of the token.
+_CREDENTIAL_ERRORS = (AirflowNotFoundException, ModalConnectionError)
+# Serializes building a backend's Modal client. ModalHook resolves its connection and builds
+# its client without a lock, so concurrent first calls on a backend shared by several agent
+# runs would each open a gRPC client and keep one. Module-level rather than per instance
+# because a lock cannot be deep-copied, and operators holding a backend are.
+_CLIENT_BUILD_LOCK = threading.Lock()
+
 
 @dataclass
 class _TrackedSandbox:
@@ -196,11 +209,12 @@ class ModalSandboxBackend(AttachableSandboxBackend):
     tags; keys starting with ``airflow_`` are reserved for them and overwrite any
     ``tags`` of the same name.
 
-    **Credentials are ambient.** Modal is authenticated the same way its CLI is: run
-    ``modal token new`` once to write ``~/.modal.toml``, or set ``MODAL_TOKEN_ID`` and
-    ``MODAL_TOKEN_SECRET`` in the worker environment. Nothing is read until the first
-    sandbox is created, so a Dag file that constructs this backend parses without
-    credentials present.
+    **Credentials come from a** ``modal`` **connection**, resolved by
+    :class:`~airflow.providers.modal.hooks.modal.ModalHook` in the order the
+    :ref:`Modal connection page <howto/connection:modal>` sets out; without a
+    ``modal_default`` connection that is the worker's own Modal credentials. Nothing is
+    read until the first sandbox is created or attached to, so a Dag file that constructs
+    this backend parses without the connection or any credentials present.
 
     **What the network policy can and cannot promise.** ``SandboxSpec(block_network=True)``
     maps to Modal's own ``block_network``, which drops all outbound traffic including DNS.
@@ -235,6 +249,9 @@ class ModalSandboxBackend(AttachableSandboxBackend):
     :meth:`read_file`, which deliberately stays on the base class's shell implementation
     (see that method). Any Debian or Ubuntu based image, including ``python:*-slim``, does.
 
+    :param modal_conn_id: The ``modal`` connection to authenticate with. Default
+        ``"modal_default"``. ``None`` uses the worker's Modal credentials without looking
+        for a connection.
     :param image: Registry tag for the sandbox image, or a prepared ``modal.Image``.
         Default ``"python:3.12-slim"``. An image carrying the packages an agent needs is
         the alternative to opening egress so it can install them:
@@ -287,6 +304,7 @@ class ModalSandboxBackend(AttachableSandboxBackend):
     def __init__(
         self,
         *,
+        modal_conn_id: str | None = ModalHook.default_conn_name,
         image: str | modal.Image = DEFAULT_IMAGE,
         app_name: str = DEFAULT_APP_NAME,
         create_app_if_missing: bool = True,
@@ -330,6 +348,9 @@ def __init__(
             _validate_positive_finite(memory, "memory")
         if egress_enforcement not in ("strict", "sni"):
             raise ValueError(f"egress_enforcement must be 'strict' or 'sni', got {egress_enforcement!r}.")
+        # Constructing the hook reads no connection and opens no client, so this is safe at
+        # Dag-parse time; both wait for _connected_hook.
+        self._hook = ModalHook(modal_conn_id=modal_conn_id)
         self._image = image
         self._app_name = app_name
         self._create_app_if_missing = create_app_if_missing
@@ -347,6 +368,25 @@ def __init__(
         # runs never has two of them touching the same entry.
         self._tracked: dict[str, _TrackedSandbox] = {}
 
+    def _connected_hook(self) -> ModalHook:
+        """
+        Return the hook with its client built, the one place every Modal call goes through.
+
+        Nothing the model does can fix a missing or half-filled connection, so it fails the
+        task, naming the connection the author set. That includes ``destroy``: the sandbox
+        would otherwise bill until its lifetime ends, and the toolset's own teardown catches
+        and logs it, so it still never fails a finished agent run. A Modal error from
+        building the client propagates unchanged for the caller to classify.
+        """
+        with _CLIENT_BUILD_LOCK:
+            try:
+                self._hook.get_conn()
+            except _CREDENTIAL_ERRORS as e:
+                raise SandboxTerminalError(
+                    f"Could not read Modal credentials from connection {self._hook.modal_conn_id!r}: {e}"
+                ) from e
+        return self._hook
+
     # ------------------------------------------------------------------
     # Lifecycle.
     # ------------------------------------------------------------------
@@ -359,16 +399,16 @@ def create(self, *, spec: SandboxSpec | None = None) -> str:
         self._check_attachable(spec)
         name = _new_sandbox_name()
         try:
-            # Looked up per create rather than memoized on the instance: the lookup is
-            # idempotent server-side, and one round trip per sandbox is cheaper than the
-            # locking a shared cache would need, given the toolset shares one backend
-            # across concurrent runs.
-            app = modal.App.lookup(self._app_name, create_if_missing=self._create_app_if_missing)
             # A registry tag is the common case; a prepared Image is how packages get
             # into the sandbox without opening egress to fetch them.
             image = modal.Image.from_registry(self._image) if isinstance(self._image, str) else self._image
-            sandbox = modal.Sandbox.create(
-                app=app,
+            # The hook looks the app up in the connection's environment on every create
+            # rather than memoizing it: the lookup is idempotent server-side, and one round
+            # trip per sandbox is cheaper than the locking a shared cache would need, given
+            # the toolset shares one backend across concurrent runs.
+            sandbox = self._connected_hook().create_sandbox(
+                app_name=self._app_name,
+                create_app_if_missing=self._create_app_if_missing,
                 image=image,
                 name=name,
                 tags=self._create_tags(spec, name),
@@ -497,7 +537,9 @@ def destroy(self, sandbox: str) -> None:
         self._check_handle(sandbox)
         tracked = self._tracked.pop(sandbox, None)
         try:
-            target = tracked.handle if tracked and tracked.handle else modal.Sandbox.from_id(sandbox)
+            target = (
+                tracked.handle if tracked and tracked.handle else self._connected_hook().get_sandbox(sandbox)
+            )
             target.terminate()
         except modal.exception.NotFoundError:
             # Already gone, which is what destroy is for. Idempotent by contract.
@@ -984,7 +1026,7 @@ def _handle(self, sandbox: str) -> modal.Sandbox:
         try:
             # Reachable when the handle came from another backend instance, or from a
             # caller that created the sandbox elsewhere.
-            found = modal.Sandbox.from_id(sandbox)
+            found = self._connected_hook().get_sandbox(sandbox)
         except modal.exception.Error as e:
             raise self._as_sandbox_error(e, sandbox=sandbox) from e
         if tracked is None:
@@ -1050,9 +1092,15 @@ def _as_sandbox_error(self, error: modal.exception.Error, *, sandbox: str | None
             # error. Only reachable if it escapes from somewhere that cannot report it.
             return SandboxError(f"The command hit its deadline: {error}")
         if isinstance(error, modal.exception.AuthError):
+            if self._hook.credentials is not None:
+                # The token came from the connection, so worker settings would change nothing.
+                return SandboxTerminalError(
+                    f"Modal rejected the token on connection {self._hook.modal_conn_id!r}. Update its "
+                    f"login and password: {error}"
+                )
             return SandboxTerminalError(
-                "Modal rejected the credentials. Run 'modal token new', or set "
-                f"MODAL_TOKEN_ID and MODAL_TOKEN_SECRET on the worker: {error}"
+                "Modal rejected the credentials. Create a 'modal' connection, run 'modal token "
+                f"new', or set MODAL_TOKEN_ID and MODAL_TOKEN_SECRET on the worker: {error}"
             )
         if isinstance(error, modal.exception.PermissionDeniedError):
             # A sibling of AuthError rather than a subclass, and just as unfixable by