Integrations

There are two distinct categories of OAuth, backed by two distinct applications:

User login — sign up and sign in with GitHub, Google, Microsoft or LinkedIn.
Workspace integrations — connect an external service so agent tools can use it.

Connecting a workspace integration

Get the authorisation URL

GET /api/integrations/{provider}/{service}/connect

User consents

On the provider’s consent screen.

Provider redirects back

POST /api/integrations/{provider}/callback

Tokens are stored encrypted

In the integrations table, encrypted with ENCRYPT_KEY.

Agent tools then use those tokens transparently.

Provider	Services	Scopes
Google	Drive, Gmail, Calendar, Sheets, Docs	Service-specific, e.g. `gmail.readonly`, `drive.readonly`
Microsoft	Outlook, Teams, OneDrive, SharePoint	Service-specific, e.g. `Mail.Read`, `Files.ReadWrite`
GitHub	Repositories, Gists	`repo`, `gist`, `read:user`

Method	Endpoint	Description
GET	`/api/integrations`	List connected integrations
GET	`/api/integrations/google/{service}/connect`	Google authorisation URL
POST	`/api/integrations/google/callback`	Google callback
GET	`/api/integrations/microsoft/{service}/connect`	Microsoft authorisation URL
POST	`/api/integrations/microsoft/callback`	Microsoft callback
GET	`/api/integrations/github/connect`	GitHub authorisation URL
POST	`/api/integrations/github/callback`	GitHub callback
DELETE	`/api/integrations/{provider}`	Disconnect