Custom OAuth
The generic connection for any OAuth 2.0 provider. Reach for it when you want an HTTP Request or OpenAPI action to call a service that has no connection type of its own—so the authorization is held, refreshed, and reused here instead of being pasted into a header on every node.
Most providers need only a discovery URL. The rest of the form exists for the ones that don't, and stays out of sight until you ask for it: each section appears once the one above it is open, and a section holding data locks open so it cannot be collapsed out of view.
Fields
| Field | Description |
|---|---|
| Name | What the connection is called wherever it is offered. |
| Discovery URL | The provider's discovery or issuer URL. On save, its OAuth endpoints and scopes are detected automatically, and where the provider supports it a client is registered for you when you connect. An OpenAPI security-scheme fragment also works here. Leave blank to fill in the fields by hand. |
Custom OAuth 2.0 authentication
Client credentials
| Field | Description |
|---|---|
| Provide client credentials | Switch on for a provider that requires you to register an OAuth client yourself and paste in its credentials. Providers that register a client automatically don't need this. |
| Client ID | The client ID from the provider's developer console. |
| Client Secret | Its secret. Omit for a public client. |
Endpoints and scopes
| Field | Description |
|---|---|
| Set endpoints and scopes manually | Switch on for a provider that publishes no discovery document. Filled in and locked when a discovery URL did the work. |
| Authorize URL | The provider's authorization endpoint. |
| Token URL | The provider's token endpoint. |
| Scopes | The scopes to request. |
Each of these shows the discovered value as a placeholder, so you can see what was detected and type over it only where you need to.
Advanced protocol options
The provider-quirk cluster. Everything here has a sensible default, and most providers need none of it.
| Field | Description |
|---|---|
| Revoke URL | The revocation endpoint, where the provider offers one. |
| Scope Delimiter | How multiple scopes are joined into one value. A space unless set. |
| Token Endpoint Auth Method | How credentials are presented to the token endpoint. HTTP Basic unless set or discovered. |
| Refresh Rotates | Switch on for a provider that issues a fresh refresh token with every refresh, so the stored one is replaced rather than reused. |
| Resource | A resource indicator sent on the authorize and token requests, binding the issued token's audience to that URL. Defaults to the protected resource the token will be used against. |
| Extra Authorize Params, Extra Token Params | Additional name/value parameters some providers require on those requests. |
| Disable PKCE | PKCE is on by default and is required by OAuth 2.1. Switch this on only for a legacy server that rejects the extra parameters. |
Connecting
Once the fields are filled in—by discovery or by hand—click Connect to authorize. You are sent to the provider to sign in and grant access, then returned with the connection active.
Gotchas
Discovery runs on save, and only when the Discovery URL you pasted differs from the one it last ran on. That is deliberate: hand edits you make to the endpoints afterwards survive later saves. Paste a different URL to run discovery again.
A discovery URL that cannot be reached, or that returns something unusable, reports the failure on the field rather than saving a half-configured connection.