Integrations
| Integration | Use it to | Page |
|---|---|---|
| OAuth connectors | Let people connect their own Google Drive, OneDrive, Outlook, SharePoint or Teams | This page |
| REST APIs | Turn an OpenAPI document into tools with API key, Bearer, Basic or OAuth2 auth | This page |
| MCP servers | Give agents tools in any system that has an MCP server | Skills and MCP |
| Chat platforms | Connect WeCom, Feishu or DingTalk through their own sign-in | Plugin platforms field |
OAuth connectors
People can connect their own Google Drive, OneDrive, Outlook, SharePoint and Microsoft Teams accounts. Company shared connections can't use an admin's personal OAuth.
One-time setup for admins
- Register a web app with Google and/or Microsoft. Set the redirect URL to
HUB_PUBLIC_URL+/api/v1/mcp-servers/oauth/callback. In production this must be a fixed HTTPS address; only local development allowslocalhostover HTTP. - Set these on the Hub:
| Setting | Value |
|---|---|
CONNECTOR_OAUTH_KEY | A Fernet key, for example from cryptography.fernet.Fernet.generate_key() |
CONNECTOR_GOOGLE_CLIENT_ID, CONNECTOR_GOOGLE_CLIENT_SECRET | Google app credentials |
CONNECTOR_MICROSOFT_CLIENT_ID, CONNECTOR_MICROSOFT_CLIENT_SECRET | Microsoft app credentials |
CONNECTOR_MICROSOFT_TENANT | organizations by default, or an approved tenant ID |
Every Hub node must use the same key, app settings, HUB_PUBLIC_URL and database. Back up the key: replacing it makes existing authorizations unreadable. Hide query strings on the callback path in your proxy and access logs, so one-time codes aren't recorded.
Some Microsoft permissions need tenant admin consent, and a Google app may need review before wide use.
How authorizations are handled
- Authorization code flow with PKCE (S256), a random
state, a 10-minute limit and single use. - Tokens are stored encrypted and bound to the Hub, device, user, connector and connection. Access tokens are injected only when the server dispatches work or runs a check.
- These five connectors are read-only: writes are forced off.
- Authorizations are never exported, imported or shared. The target account signs in again.
- Removing a connection deletes its local tokens. It doesn't revoke the app at the provider; do that in the provider's account settings.
Connection states
| State | Meaning |
|---|---|
configured | Settings and tool list are available; the account hasn't been checked |
verified | A reviewed read-only identity call succeeded |
needs_auth | The provider rejected the authorization. Connect again |
offline | The runner it needs isn't online |
error | Network or runtime problem. The account isn't assumed to be invalid |
REST APIs from OpenAPI
Import an OpenAPI 3.0 or 3.1 document (JSON or YAML), or a simplified API list. SoduWork generates the auth fields: API key, Bearer, Basic or OAuth2.
- OAuth2 supports the authorization code flow with PKCE,
client_secret_basic,client_secret_postand public clients. Enter the system's client ID and secret on the connection page, register the Hub's callback address with that system, then choose Sign in and connect. - Writes are off by default. Turning them on requests that tool's scope.
- Requests don't follow redirects, limit response size, check the real address and block system metadata addresses. Uncertain writes aren't retried.
- Company shared connections should use a company API key or client credentials, not personal OAuth.
Besides CONNECTOR_OAUTH_KEY and a valid HUB_PUBLIC_URL, no extra server settings are needed per system.