Developer Platform

Connectors, OAuth, and provider secrets

Discover supported connector types and configure data, payment, and OAuth connections without sending raw provider secrets.

The connector registry tells a client which integration families and capabilities the current gateway supports. The public set includes REST and GraphQL data connectors, outbound webhooks, standard OAuth connections, Stripe payment connectors, and installed services.

Discover before configuring

GET /v1/apps/{saasAppId}/connector-types
GET /v1/apps/{saasAppId}/data-connectors
GET /v1/apps/{saasAppId}/payment-connectors
GET /v1/apps/{saasAppId}/oauth-connections

Discovery is permission-filtered and returns public connector metadata—not connector instances belonging to another app, secret references, destination secrets, tenant routing, or internal database connector types.

Data connectors

REST and GraphQL connectors require public HTTPS endpoints. Mutating operations must be explicitly allowlisted. Create and update requests accept a protected secret reference, never the raw provider credential itself.

Payment connectors

The current payment connector type is Stripe. Provider endpoints remain server-owned, and both credential and webhook-secret references are required where applicable. Arbitrary provider types and caller-selected provider base URLs are rejected.

OAuth lifecycle

1. Start an authorization for a registered provider and requested provider scopes.
2. Redirect the user to the returned provider authorization URL.
3. Complete the one-time state with the provider code.
4. Refresh or revoke by the returned connection ID.

The platform uses authorization code + PKCE, one-time hashed state, encrypted token envelopes, and leased refresh/revoke operations. Provider authorization/token endpoints and client credentials are registered server-side.