About

OAuth app. You register one per product in the provider's developer portal. It holds the client ID, client secret, redirect URIs, scopes, and the name users see on the consent screen. The provider reviews the OAuth app, not each user.

Auth config. Points at one OAuth app: Composio's managed app or your own.

Connected account. Created when a user authorizes the OAuth app. The app's review status decides whether the user sees a warning or is blocked.

Composio provides OAuth apps for many toolkits. Users see Composio on the consent screen, quota is shared, and triggers poll at most every 15 minutes.

Use your own OAuth app for your name on the consent screen, custom scopes, dedicated quota, faster polling, or custom instances. You can mix per toolkit.

A new auth config applies only to new connections. Existing users keep their connection until they re-authenticate, or until you import their credentials where Composio supports it.

See Managed vs custom auth, Managed OAuth apps, and White-labeling authentication.

• Tier 1 · Self-serveAny user can connect after you register. No review.
• Tier 2 · Self-serve, optional reviewAny user can connect. Review applies only to a public listing or higher limits.
• Tier 3 · Review requiredThe provider must approve the app before users outside your test list can connect.
• Tier 4 · Review + external auditReview plus a third-party security assessment. Often paid and yearly.
• Tier 5 · GatedRequires a partner application, paid plan, or business approval. The provider can refuse.

Scopes decide the tier. Select what your agent needs on a guide to see your tier. Customer-side gate means your users' admins may need to approve the app.

• TestedA person completed the step. The date is noted.
• ProbedThe agent called the provider's endpoint with a fake client ID and recorded the response.
• SourcedThe linked page states it. The agent opened the page.
• InferredReasoning from related facts. Check it before you rely on it.

Each guide also shows how far the checks got:

• Docs read. The agent read the provider's docs.
• Endpoints probed. The agent called the OAuth endpoints with a fake client ID.
• Portal checked. The agent loaded the developer portal without signing in.
• Set up by a person. A person completed the steps.

Live guides. An agent (Claude) searches the docs, opens the pages it cites, probes the OAuth endpoints, and checks Composio's managed apps. Code marks a claim sourced only if the agent opened that page. Live guides are never marked tested.

Verified guides. One agent wrote each guide from official sources. A second agent, without the first one's notes, checked every tier-deciding claim and fixed errors. Corrections are listed on each guide and in verification/.

Limits. No agent signs in, creates accounts, or submits forms. Sign-ins, DNS, legal terms, documents, payments, and recordings are marked as yours.

1. Generate guides with the live agent.
2. Verify tier-deciding claims with a second agent. Send disagreements to a person.
3. Set up the top 20 apps by hand.
4. Re-check monthly and flag tier changes.
5. Collect "this step was different" reports from developers.

• Provider rules change. Each guide shows its research date.
• Wait times come from few developer reports.
• No claim is tested yet.
• Live guides come from one agent run.

Back to library