OAuth & account sign-in

“OAuth” shows up in several places in ExoHuman. This page explains each and what is supported today.

Model provider accounts

In Settings → Models → Add provider, Anthropic, OpenAI and Google can be connected with an account sign-in (Claude, ChatGPT or Google account) instead of an API key. The sign-in uses the vendor’s own OAuth flow; tokens are stored encrypted and refreshed automatically. Signed-in connections behave exactly like API-key connections. Existing vendor CLI credentials can also be imported.

Separately, each agent can be signed in to its runtime’s provider from Settings → Storage → Model sign-in (Runtimes).

Slack installation

Connecting Slack to your instance is a complete OAuth flow: Install to Workspace in Settings → Integrations → Slack. See Slack.

Single sign-on for people

People can sign in to your instance with your identity provider through OIDC (Google Workspace, Microsoft Entra ID, Okta and others). See SSO & 2FA.

Tokens for other services

For services an agent uses through its tools or MCP servers — Google Drive, Notion, GitHub, your CRM — ExoHuman does not offer one-click “Connect” buttons that complete an OAuth flow and store the token for you. Instead:

1. Obtain a token from the provider (a personal access token, API key, or an OAuth token from the provider’s own tooling).
2. Add it to the agent as a credential (Credential management) — usually an .env variable referenced by .mcp.json.template, or an uploaded credential file such as a Google service-account JSON.
3. For a secret shared by many agents, store it once in the credential vault.

Google sign-in links inside an agent

Some tools an agent runs sign in to Google with a desktop-style flow: they print a consent link and wait for a redirect to 127.0.0.1. ExoHuman’s output sanitiser normally scrubs URLs that look like secrets; strictly shaped Google authorisation links are kept so you can open them, approve access and complete the tool’s sign-in.

Integration API

GET /api/oauth/providers lists the providers the instance has OAuth client credentials for (Google, GitHub, Slack, Notion) and the scopes it would request; POST /api/oauth/{provider}/init builds an authorisation URL. These are building blocks for integrations — the resulting token still has to be added to an agent as a credential.