OAuth Integrations
OAuth integrations use a popup-based authorization flow. Tokens are encrypted in the vault and refreshed automatically.Flow
- User clicks “Connect” on the Integrations page
- Backend returns an auth_url for the OAuth provider
- Frontend opens a popup to that URL
- User authorizes in the popup
- Provider redirects back with an auth code
- Backend exchanges code for tokens, stores encrypted
- Integration marked as connected
Supported Providers
Token Security
- Encrypted at rest with per-user keys
- Refresh tokens rotated on every use
- Auto-expire and re-authorize if refresh fails
- Immediate revocation on disconnect
- Never logged or exposed to agents directly