Custom OAuth Setup

Use a server-side OAuth integration for private systems. The browser starts authorization, the backend owns the client secret and tokens, and webhook processing uses only server-side credentials.

Choose the right flow

Connection sequence

1. 01

   Register the redirect URI

   Register an exact HTTPS callback owned by the application backend.

2. 02

   Create an integration session

   Store a short-lived state value tied to the authenticated workspace and requested scopes.

3. 03

   Redirect for authorization

   Request the minimum scopes needed for contact lookup, updates, and activity creation.

4. 04

   Exchange the code server-side

   Validate state, exchange the authorization code, and never expose the client secret to the browser.

5. 05

   Encrypt and test tokens

   Store tokens in a managed secret store, run a read-only probe, then enable write scopes.

Token handling

• Encrypt access and refresh tokens at rest
• Keep tokens out of URLs, logs, analytics, and client-side storage
• Refresh before expiry and handle revoked or unauthorized tokens
• Scope each integration to the minimum workspace and record permissions needed
• Provide a disconnect action that revokes and deletes stored credentials

Failure handling