OAuth Apps for Agent Connections

How OAuth works for agent sign-in connections (Slack, Google, GitHub, etc.) — your own app is recommended; the platform can mint a sentinel placeholder, but some sign-ins will require yours.

Written By Philippe

Last updated 30 days ago

OAuth Apps for Agent Connections

Some of your agent's connections use OAuth — the "Sign in with…" flow (Slack, Google, GitHub, and similar). Those flows always run through an OAuth app registered with the provider. Publishing now lets you ship the agent without one; the platform mints a sentinel placeholder integration and asks your buyer to supply one at connect time for any provider that requires it.

Do I Need To?

Recommended, not required. OAuth apps you register are required for these providers:

  • Atlassian Jira / Confluence (the per-workspace token endpoint)
  • ServiceNow (per-instance)
  • WordPress (per-site)
  • Mautic
  • Shopify
  • Zendesk

For the rest of your agent's OAuth connections, the platform will mint a sentinel placeholder integration and route buyer sign-ins through it. Buyers who encounter a provider that needs your app see a 409 needsOwnApp from POST /api/v1/credentials/:instanceId/connections, with the provider list in the response body.

If you see that message in production for a provider on the list above, register your OAuth app for that provider and re-publish the agent.

What You Provide

Two values from the provider's developer console:

  • Client ID — public identifier of your OAuth app.
  • Client Secret — treated like a password; stored encrypted in the Secure Vault, never shown to buyers.

For providers that need provider-specific config (Shopify / Zendesk / ServiceNow / WordPress), the credential wizard now collects the subdomain / instance / site on the OAuth step as well.

How to Register an OAuth App

The steps are provider-specific, but the shape is always:

  1. Open the provider's developer console (e.g. Slack → Your Apps, Google Cloud → Credentials, GitHub → Developer settings → OAuth Apps).
  2. Create a new OAuth app.
  3. Set the redirect URL shown in the publish form for that provider.
  4. Copy the Client ID and Client Secret into the form.

Grant only the scopes your agent's nodes actually need — buyers see the consent screen and over-broad scopes hurt trust.

What Buyers See

When a buyer activates your agent, the OAuth consent screen shows your app's name. They sign in with their own account; you never see their tokens. If you did not supply an OAuth app for a provider, the buyer sees a "this integration needs the publisher's OAuth app" message and must wait until you re-publish.