App authorisation
The four ways an app in the catalogue authorises, how the OAuth request-access path works, and what Meddle stores for a connection.
Every app in the catalogue falls into one of four connect kinds. The kind is a property of the app, not something you select.
It is worked out on the server from the app's own authentication configuration rather than trusted from the browser.
The four connect kinds
| Kind | What you do | What happens |
|---|---|---|
| No authentication | Press Add | The app needs no account at all. There is no sign-in and no consent screen. It is recorded against the agent immediately and is ready to use. |
| One-click sign-in | Press Connect, sign in | Meddle's platform account brokers the authorisation. You sign in to the service and approve access. No credentials are typed into Meddle. |
| Your own API key | Press Connect, paste the key | You supply an API key or token for the service. It is collected on the authorisation provider's own hosted page, not in a Meddle form. |
| Your own OAuth application | See below | The app supports only OAuth and there is no shared application to broker it, so it needs an OAuth application registered by you, with its own client ID and secret. |
Apps that need your own OAuth application
HighLevel connects with one-click sign-in
HighLevel has a Meddle-provided OAuth application, so it behaves like the second row: you press Connect and sign in, and there are no credentials to enter.
Other apps in this category show a Request access button. Pressing it asks our team to register an OAuth application for that app, after which it becomes a one-click sign-in for everyone. It does not connect the app and it does not collect any credentials from you.
If you need an integration now, build it as a webhook tool with your own API key stored as a secret variable.
Why an assistant cannot connect one
An app that needs your own OAuth application cannot be connected by asking an assistant. The client secret would have to pass through the language model to get there, which is not allowed, so the assistant refuses and points you back to the app.
See connect your assistant for what an assistant can do with connections.
What is stored
When you connect an app, Meddle stores the app, its scope, and who connected it, plus an opaque reference to the account held by the authorisation provider. That reference is not a secret and not a token.
What is never stored
Meddle never receives, stores, or logs the OAuth access token for a connected account, and never receives the client secret of an OAuth application. Those live with the authorisation provider.
Tool arguments, which can contain caller information, are not written to logs either.
For credentials you do hold yourself, such as an API key used in a webhook tool's header, see variables and secrets.