User authentication
Each user connects with their own account. Choose OAuth or OpenID Connect with your own login, or a personal API key per user.
On this page
When a user connects Claude, ChatGPT, WhatsApp or the web chat to your API, Connect needs a credential of that user to call your API on their behalf. You choose how they get it, on the Authentication step.
| Mode | The user | Connect sends on each call |
|---|---|---|
| OAuth or OpenID Connect | Signs in on your own login page | Authorization: Bearer <access token> |
| API key | Pastes a personal key on a Connect page that shows your verified domain | The key where you say, for example Authorization: Bearer <key> |
Credentials are stored encrypted and never reach the AI model. See Security and privacy.
OAuth or OpenID Connect
Register Connect as a client in your OAuth provider with this callback, replacing acme with your slug:
https://connect.grostify.com/t/acme/oauth/callbackThe callback appears once your domain is verified. Register this exact URL.
Fields
| Field | Required | Notes |
|---|---|---|
| Issuer | For OpenID Connect | Base URL of your provider. It is compared character by character. |
| Authorization endpoint | Yes | HTTPS. |
| Token endpoint | Yes | HTTPS. |
| Userinfo endpoint | One of the two | Connect calls it with the access token to know who the user is. |
| JWKS URI | One of the two | With the issuer, lets Connect validate the id_token. |
| Revocation endpoint | No | Connect calls it when you revoke a connection. |
| Client ID | Yes | Up to 256 characters. |
| Client secret | Yes | Saved apart and never shown again. 8 to 1,024 characters. |
| Scopes | No | Separated by spaces, up to 20. |
| Client authentication | Yes | client_secret_basic (default) or client_secret_post. |
| User id claim | No | Claim or dot path with the user's id. sub when empty. |
All endpoints must be on the same registrable domain as the issuer or the authorization endpoint.
Tip
Include offline_access in the scopes. Without it many providers do not return a refresh token, and users have to reconnect each time the access token expires.
Discover
Type the issuer and click Discover. Connect reads /.well-known/openid-configuration and fills in the endpoints, suggests scopes and picks a supported client authentication. It does not save anything: review the fields and save.
What your provider needs to support
- Authorization code flow over HTTPS.
- PKCE with
S256. Connect always sends its ownstateand PKCE pair. - The exact
redirect_uriabove. client_secret_basicorclient_secret_post.- Refresh tokens are optional but recommended.
How Connect identifies the user
- If your provider returns an
id_tokenand you set the issuer and the JWKS URI, Connect validates it (signature,iss,audandexp, with 60 seconds of tolerance). - Otherwise it calls the userinfo endpoint.
- The user's label in Connections is their
email,preferred_usernameorname.
Token refresh
Connect refreshes the access token 60 seconds before it expires. If your API answers 401, Connect refreshes once and retries. If your provider rejects the refresh token, the connection is closed and the user has to connect again.
API key
Each user pastes a personal key on a Connect page. Connect checks it with a real call to your API before saving it.
Fields
| Field | Example | Notes |
|---|---|---|
| Send the key in | A header | A header or a query parameter. |
| Header or parameter name | Authorization | 1 to 64 characters. host, cookie, accept, user-agent and other reserved headers are not allowed. |
| Prefix | Bearer | Optional, with its trailing space if you need it. |
| Verification path | /me | A GET, relative to the base URL, that answers 200 with the user's data when the key is valid. |
| User id field | data.id | Dot path to the user's id in that response. |
| Page where users get their key | https://acme.com/settings/keys | HTTPS, on your verified domain. Required to request review. |
| Key prefix | sk_live_ | Optional. Helps spot keys pasted where they should not be. |
What the user sees
- They approve the access on a Connect page that shows your verified domain.
- They paste their key. Connect calls your verification path with it, exactly as it will on each tool.
- If your API answers 200 with a user id, the key is saved. A 401 or 403, or any other status, shows: "We could not verify that key."
They have 10 attempts every 10 minutes. Connect only shows the last 4 characters of a key again.
Test credential
The test credential is a real access token or API key of a test user. Connect uses it only for the Run test button of each tool. It is stored encrypted and only its last 4 characters are shown, to owners and admins.
Change the configuration
Warning
Changing the mode, or where the key goes (header or parameter, name or prefix), resets the test of every tool and disables all tools in every channel.
If the integration is live, saving any change to authentication or a new client secret sends it back to review and closes every connection. Users connect again once Grostify approves it.
Saving authentication, the client secret or the test credential needs a recent sign in (within the last 10 minutes).