Skip to content
ConduitConduit

Connecting OAuth vendors

Most vendors in Conduit’s catalog connect with an API key you create in the vendor’s portal — those each have their own walkthrough. This page covers the other family: OAuth vendors, where there is no key to paste. You click Connect, approve access on the vendor’s own consent screen, and Conduit handles the tokens from there. All 34 OAuth vendors share the same flow, so one page covers them all. Syncro is the one exception on the connect page itself: Sign in with Syncro is the button, and an API key plus subdomain stays under Headless / service account until you open it. Conduit does not send you to Syncro until you click sign-in.

How the flow works

Section titled “How the flow works”
  1. In Conduit, go to Connections (/org/catalog) and click Connect on the vendor — or open its connect page directly at /connect/<slug> (for example /connect/notion). Expected: for most OAuth vendors there is no credential form; Conduit sends you straight to the vendor. Syncro (/connect/syncro-official) stops on its own page first, with sign-in as the primary action.
  2. Your browser is redirected to the vendor’s own sign-in and consent screen. Sign in with your account at that vendor if you aren’t already.
  3. Review the requested access and click the vendor’s approve button. Conduit requests conservative scopes — for several vendors the initial rollout is deliberately read-only.
  4. The vendor redirects you back to Conduit. Expected: a green Connected status on the vendor.

From then on:

  • Token refresh is automatic. Conduit stores the vendor’s tokens encrypted and refreshes expired access tokens on its own — including vendors whose tokens live only minutes. You never re-approve just because a token expired.
  • Disconnect revokes stored tokens. Disconnecting the vendor removes the stored grant from Conduit; reconnecting later simply runs the consent flow again.

Standard vs bring-your-own-client (BYOC)

Section titled “Standard vs bring-your-own-client (BYOC)”

For standard OAuth vendors, Conduit already has an OAuth client registered with the vendor (provisioned by your Conduit operator). You click Connect and approve — nothing else.

A minority of vendors don’t allow that shared client — they restrict client registration to their own partners, or pre-approve redirect URIs per customer. For these BYOC (bring-your-own-client) vendors, your organization first registers its own OAuth app in the vendor’s developer console, using Conduit’s OAuth callback URL as the app’s redirect URI (your operator or support can give you the exact callback URL). The connect form then asks for that app’s credentials before starting the consent flow:

  • Confidential-client BYOC — the form asks for OAuth Client ID and OAuth Client Secret (the vendor issues both when you register the app).
  • Public-client BYOC — the form asks only for OAuth Client ID; these vendors issue no secret and the exchange is secured with PKCE instead.

Once the client credentials are saved (the secret is stored encrypted, like any other Conduit credential), the flow continues exactly like a standard vendor: consent screen, approve, Connected.

BYOC vendors

Section titled “BYOC vendors”
Vendor Category You supply Register your app at
Asana Productivity Client ID + Client Secret Asana OAuth docs
Box Productivity Client ID + Client Secret Box Developer Console
ClickUp Productivity Client ID only ClickUp MCP docs
Figma Developer Tools Client ID + Client Secret Figma MCP docs
Intercom Productivity Client ID only Intercom MCP docs
Plaid Productivity Client ID only Plaid docs
Square Productivity Client ID only Square MCP docs
Vercel Developer Tools Client ID only Vercel MCP docs

The OAuth vendor catalog

Section titled “The OAuth vendor catalog”

Standard vendors (click Connect and approve)

Section titled “Standard vendors (click Connect and approve)”
Vendor Category Slug
QuickBooks Online Accounting & Finance qbo
Xero Accounting & Finance xero
HubSpot CRM hubspot
Cloudflare Developer Tools cloudflare
Neon Developer Tools neon
Netlify Developer Tools netlify
Sentry Developer Tools sentry
Supabase Developer Tools supabase
Atomus Security atomus
Syncro Remote Monitoring & Management syncro-official
Datadog Network Monitoring & Security datadog
Grafana Network Monitoring & Security grafana
Airtable Productivity airtable
Atlassian Productivity atlassian
Canva Productivity canva
Dropbox Productivity dropbox
Fathom Productivity fathom
Gmail (Google Workspace MCP) Productivity google-gmail
Google Calendar (Google Workspace MCP) Productivity google-calendar
Google Drive (Google Workspace MCP) Productivity google-drive
Linear Productivity linear
Miro Productivity miro
Notion Productivity notion
PayPal Productivity paypal
Zapier Productivity zapier
Calendly Scheduling calendly

BYOC vendors (register your own app first)

Section titled “BYOC vendors (register your own app first)”
Vendor Category Slug
Figma Developer Tools figma
Vercel Developer Tools vercel
Asana Productivity asana
Box Productivity box
ClickUp Productivity clickup
Intercom Productivity intercom
Plaid Productivity plaid
Square Productivity square

The three Google Workspace entries share one Google OAuth client on the operator side, but each entry requests only its own service’s scopes — so connecting Gmail consents to Gmail access only, not Calendar or Drive.

Troubleshooting

Section titled “Troubleshooting”
Symptom Likely cause
Clicking Connect shows a “not provisioned yet” page instead of the vendor’s consent screen Your Conduit operator hasn’t provisioned that vendor’s OAuth client yet. Nothing is wrong with your account or the vendor — the shared client simply isn’t set up. Contact your operator or support.
Syncro asks you to click Sign in with Syncro instead of leaving Conduit immediately That is the Syncro connect page. Sign-in is the default. Headless / service account is where an API key and subdomain go, and it is closed until you open it. An organization already using Syncro (API connector) stays connected there with no reconnect.
You denied consent (or closed the vendor’s screen) No connection is created — this is safe. Click Connect again when you’re ready to approve.
Vendor shows Connected, but tool calls fail with authorization errors The grant was revoked or expired on the vendor’s side — a password reset, an admin revoking the app in the vendor’s security settings, or a grant lapsing beyond refresh. Disconnect, then Connect again to run consent fresh.
BYOC vendor: the consent screen shows an app error (unknown client, redirect mismatch) instead of a consent prompt The Client ID/Secret you entered doesn’t match an app at the vendor, or the app’s redirect URI doesn’t exactly match Conduit’s callback URL. Fix the app in the vendor’s developer console and reconnect.
Dropbox: you approve access, then land back on the not-connected form Dropbox only returns a refresh token when authorize asks for offline access. Conduit sends that request. The shared Dropbox app has to allow short-lived tokens and the permissions Conduit asks for: account_info.read, file_requests.read, file_requests.write, files.content.read, files.content.write, files.metadata.read, files.metadata.write, sharing.read, and sharing.write. Until Dropbox sign-in is set up, Connect still accepts an app key and secret. A connection that still uses a pasted app key keeps working until November 9, 2026. The admin banner appears only after Dropbox sign-in is available on this cell. See the Dropbox guide. Conduit will not store a connection it cannot refresh.
Read tools work, but write actions are denied Several vendors are connected with deliberately read-only scopes in the current rollout. If you need write access, ask your operator whether write scopes are enabled for that vendor.
Connection worked for weeks, then every call fails at once Vendor-side revocation (see above) or, for BYOC vendors, the OAuth app itself was deleted or its secret rotated in the vendor’s developer console. Update the client credentials and reconnect.
Section titled “Related”