OAuth in Applications
The admin guide to setting up OAuth providers, configuring MCP servers and controlling what your organization's Charms can access.
|
|
Applications Can Connect Too
window.charmiq) provides a first-class secure OAuth pathway that bypasses those restrictions.The Application Bridge OAuth API
// 1. Register your application identity (do this once, on load) await window.charmiq.oauth.register({ appId: 'com.yourcompany.your-app', // Unique reverse-domain identifier name: 'Your App Name', description: 'What this app does', }); // 2. Request authorization with a provider const auth = await window.charmiq.oauth.getValidAuth({ providerUrl: 'https://accounts.google.com', scopes: ['https://www.googleapis.com/auth/analytics.readonly'], }); // auth.accessToken — use this in your API calls // 3. Refresh an expired token const refreshed = await window.charmiq.oauth.refreshAuth(auth); // 4. Revoke access when done await window.charmiq.oauth.revokeAuth(auth);
getValidAuth opens a consent popup managed by CharmIQ (the iframe can't open popups directly due to browser sandboxing). Once the user authorizes, CharmIQ returns the access token to your Application. All tokens are encrypted and stored server-side — your Application receives the token in memory; it's never exposed in client storage.Token Isolation
appId, ensuring complete separation.Two Applications connecting to the same provider for different purposes are fully independent You can revoke one Application's access without affecting another Users can see and manage each Application's connections separately
Provider Setup
getValidAuth fails with an authorization error, the Integration for that provider likely hasn't been set up yet.appId you register doesn't need to match anything in your administrator's configuration — it's just an identifier for your specific Application instance. The underlying OAuth infrastructure uses your organization's Integration credentials.For Developers — The Application Bridge's getValidAuthcall results in a Connection scoped toapplicationType: Applicationand yourappId. This is the same Connection model used by MCP servers, just with a different type discriminator. From a security standpoint, the token lifecycle and encryption are identical. The bridge serializes all OAuth communication throughpostMessagesince the iframe cannot communicate directly with CharmIQ's backend.
Patterns
Register on load, authorize on demand. Call registerwhen your Application initializes. CallgetValidAuthonly when the user actually needs the connected feature — not upfront.Revoke when the session ends. If the OAuth connection was for a specific task, revoke it when the user is done. Don't accumulate live tokens.