Bring Your Own OAuth Client

​

How Custom OAuth Works

• Your branding (custom name and logo) appears in consent screens
• Your tenant policies control user access and admin consent requirements
• Your rate limits apply to API calls made by your users
• Your user groups can authenticate through separate OAuth clients

1

Create OAuth App at Provider

Register a new OAuth application in your provider’s developer portal (Google Cloud Console, Microsoft Azure, etc.).Required Configuration:

• Copy the exact redirect URL from Langdock’s integration settings
• Select all required scopes shown in Langdock for that integration
• Configure any tenant-specific settings (admin consent, allowlisting)

2

Gather Credentials

Note down the following from your OAuth app:

• Client ID (always required)
• Client secret (required for most integrations)
• Tenant ID (optional, shown for Microsoft integrations only)

3

Configure in Langdock

Go to Workspace settings → Integrations, select the integration, and scroll to Bring your own OAuth Client.Click Add another OAuth client when the integration includes a Langdock client. If the integration requires your own client, click Configure your OAuth client to use this integration.In the configuration dialog, copy the Redirect URL into your OAuth app and review the Scopes section. Make sure all listed scopes are enabled in your OAuth app — missing scopes will cause an insufficient scopes error. You can copy all scopes at once using the copy button.For integrations with action-level permissions, we recommend keeping Sync scopes with enabled actions turned on by default. Langdock then requests the auth scopes plus the scopes required by enabled or shared actions, keeping requested scopes aligned with the actions your workspace can use. Learn more in Manage Action-Level Scopes.Optionally add a descriptive Name. Under Access, choose Entire workspace, User choice, or Groups. Enter your Client ID and Client secret (and Tenant ID if prompted for Microsoft integrations). If the integration shows extra connection fields, set those under OAuth connection details, then click Save and confirm the change.

Select the saved client from the client list and confirm the switch to activate it.

Once active, a workspace or group client applies automatically when no User choice client is active. A User choice client is used only when a member selects it. The connection only works if the credentials are valid. Existing connections stay linked to the client they were created with.

4

Test Authentication

Have a user connect their account to verify:

• Consent screen shows your client
• Required scopes are granted
• Data access works as expected through actions

​

Assign OAuth Clients to User Groups

1

Add another custom client

Click Add another OAuth client. Optionally give the client a descriptive name so you can identify it in the client list.

2

Manage client access

In the Access section, select Groups, then click Manage to choose the user group that should use this client.

3

Add credentials

Enter the Client ID, Client secret, and any fields required by the provider. Click Save and confirm the change. Select the saved client from the client list and confirm the switch to activate it.

​

Integration Settings Interface

https://app.langdock.com/api/integrations/{integration-id}/callback

​

OAuth connection details

• On the Langdock client card, click Configure when those fields appear. On dedicated deployments, that card is labeled Global client.
• On a custom client, the same fields appear in the configuration dialog and apply only to that client. A Langdock-client default does not apply to a custom-client connection.
• Leave a field empty if members should type it when they connect. Enter a value to set the default, for example https://acme.service-now.com. Each field is marked Optional.

​

Manage Custom OAuth Clients

• Select an inactive client card to activate it.
• Select an active custom client card to deactivate it.
• Click the settings icon to edit the client.
• Open the client settings and click Delete OAuth client credentials to remove it.
• Select Langdock client to use the managed client for new connections. This deactivates all custom clients.

​

Common Configuration Errors

​

Custom Miro OAuth Client

Show how to configure a Miro OAuth client

Miro returns the refresh token Langdock needs for automatic token refresh only when Expire user authorization token is enabled. You cannot change this setting after the app is created. If you already created the app without it, creating a connection fails with a Refresh token not found error. Create a new Miro app with the option enabled and replace the Client ID and Client secret in Langdock.

1

Create the app in Miro

You need a Developer team in Miro to create apps. Sign in to Miro, click your avatar, and select Settings. Open the Your apps tab and click + Create new app.Enter an app name, select your Developer team, and select the Expire user authorization token checkbox. Click Create app.

2

Connect the app with Langdock

Add the Redirect URL from Langdock’s Miro integration settings as a redirect URI in your Miro app, then enable every permission listed under Scopes in the Miro app. Miro applies the permissions configured in the app rather than requesting them during authorization.Enter the Client ID and Client secret from your Miro app in Langdock as described in How Custom OAuth Works.

​

Integrations Requiring Your Own OAuth Client

​

UiPath

​

ServiceNow

​

Shopify Admin

​

Snowflake

CREATE SECURITY INTEGRATION <integration_name>
  TYPE = OAUTH
  ENABLED = TRUE
  OAUTH_CLIENT = CUSTOM
  OAUTH_CLIENT_TYPE = CONFIDENTIAL
  OAUTH_REDIRECT_URI = '<your_redirect_uri>'
  OAUTH_ISSUE_REFRESH_TOKENS = TRUE
  OAUTH_REFRESH_TOKEN_VALIDITY = 86400;

SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<integration_name>');

https://example.com/oauth/authorize

https://<your-snowflake-account-url>/oauth/authorize