App Connections: How OAuth & API Keys Work

How OneCLI stores and injects OAuth tokens and API keys for connected apps. Token refresh, credential encryption, and the connection lifecycle.

Overview

Connect agents to external services like Gmail, GitHub, AWS, and more. The gateway handles OAuth token refresh, API key injection, and SigV4 signing automatically.

Cloud integrations

These integrations have additional features on OneCLI Cloud, such as cross-account IAM roles or managed OAuth credentials.

Service	Auth method	Highlights
AWS	Access keys (Free) or cross-account IAM role (Cloud)	SigV4 signing, per-agent session policies, temporary credentials
Datadog	API key + App key	Multi-region support, query metrics and monitors
Microsoft Word	OAuth	Read and edit Word documents in OneDrive and SharePoint
Outlook Mail	OAuth	Read, send, and manage Microsoft 365 email
Outlook Calendar	OAuth	Events, scheduling, and availability via Microsoft 365

All app connections

Google Workspace

Service	Auth method	What agents can do
Gmail	OAuth	Search, read, draft, and send emails
Google Calendar	OAuth	List events, create meetings, check availability
Google Drive	OAuth	Search, read, create, and organize files
Google Docs	OAuth	Read and create documents
Google Sheets	OAuth	Read, write, and create spreadsheets
Google Slides	OAuth	Read and create presentations
Google Forms	OAuth	Create forms, read responses
Google Meet	OAuth	Create meetings, list recordings
Google Photos	OAuth	Search and manage photos and albums
Google Tasks	OAuth	Create, complete, and organize tasks
Google Admin	OAuth	Manage users, groups, and org units
Google Analytics	OAuth	Query reports and traffic data
Google Search Console	OAuth	Search performance, URL inspection, indexing
Google Classroom	OAuth	Manage courses, assignments, students
YouTube	OAuth	Channels, search, playlists, analytics

Developer tools

Service	Auth method	What agents can do
GitHub	OAuth or GitHub App	Read and write code, manage PRs, issues, and Actions
Cloudflare	API token	Deploy Workers, manage DNS, KV, D1, Pages, Queues
Jira	OAuth	Create and update issues, search with JQL, manage sprints
Confluence	OAuth	Search, read, and create wiki pages
Notion	OAuth	Search pages, read and write content, manage databases
Todoist	OAuth	Create, complete, and organize tasks

CRM

Service	Auth method	What agents can do
Attio	OAuth or API key	Manage contacts, companies, deals, lists, notes, and tasks

Cloud and AI

Service	Auth method	What agents can do
Vertex AI	Service account or authorized user	Access Vertex AI models (Claude on GCP, Gemini)

Email and communication

Service	Auth method	What agents can do
Resend	API key	Send transactional emails, check delivery status