# Sign-in and OAuth clients

When Alice connects Google Calendar, Google shows her a consent screen that names the app asking for access. With your own OAuth client, it shows your app's name instead of Stream's.

## How a connection signs in

A connector takes one or more kinds of sign-in. The Sign-in column of the [catalog](https://getstream.io/agents/docs/connectors/catalog/) says which.

| Sign-in                  | When you use it                                                                              |
| ------------------------ | -------------------------------------------------------------------------------------------- |
| OAuth                    | A person signs in at the provider and allows access. Most connectors in the catalog          |
| OAuth client credentials | The app signs in with a client id and secret instead of a person. Only `salesforce` takes it |
| Bearer token             | You have a token from the provider, such as a GitHub personal access token                   |
| API key                  | Your own MCP server takes a key in a header, such as `x-api-key`                             |
| No authentication        | A public server, such as a shop on Shopify or DeepWiki                                       |

In the API, a connector's `schemes` and a connection's `auth_scheme` take values such as `oauth2_code`, `oauth2_client_credentials`, `bearer`, `api_key` and `none`.

## Whose OAuth client

An OAuth sign-in needs a client registered at the provider. The Sign-in column of the [catalog](https://getstream.io/agents/docs/connectors/catalog/) says which clients a connector takes:

| OAuth client               | What you set up                                                                           |
| -------------------------- | ----------------------------------------------------------------------------------------- |
| Stream's client            | Nothing. Stream registered the client at the provider                                     |
| Registered at each consent | Nothing. Stream registers a client with the provider at each sign-in                      |
| Your own client            | You register a client at the provider and [give it to Stream](#use-your-own-oauth-client) |

We recommend starting with what needs no setup: Stream's client, or the one registered at each consent. Set your own client when your users should see your app's name on the consent screen, or when the connector takes only yours, such as `linear_app`.

## Use your own OAuth client

1. **Give the client to Stream**

   Register an OAuth client at the provider, then give its id and secret to Stream. The secret is read from stdin, never from an argument:

   ```sh
   getstream agents connectors client set google_calendar --client-id 123.apps.googleusercontent.com --client-secret - < secret.txt
   ```

   ```text
   Redirect URI (add it at the provider): https://accelerate-us-east4.gcp.stream-io-api.com/v1/agents/connectors/oauth/callback
   Saved the OAuth client for google_calendar
   ```

   >
   > **Warning:** `client set` replaces what was stored: a field you leave out is removed. We encrypt the secret and never show it again, so give it each time.
   >

2. **Add the redirect URI**

   Add that redirect URI to the client at the provider.

3. **Connect as usual**

   `getstream agents connections create google_calendar --label calendar` opens Google's consent for your client in the browser, and the CLI prints `Connected` once you allow access.

To go back to Stream's client:

```sh
getstream agents connectors client remove google_calendar
```

>
> **Warning:** Connections made with your client then need a reconnect. A client Stream keeps for your app can't be removed.
>

## In the Dashboard

In the [Stream Dashboard](https://getstream.io/signin/), go to **Agents > Library > Connectors** and open **Google Calendar**. The **OAuth client** section shows the **Redirect URI** to add at the provider. Click **Set OAuth client**, type the **Client ID** and the **Client secret**, then click **Save client**.

The section then shows your **Client ID**, with **Replace** and **Remove**. As with the CLI, a save replaces what was stored, so type each secret every time.

## With the API

Your server sets the same client with one call:

```bash
curl -X PUT "$STREAM_ACCELERATION_URL/v1/agents/connectors/google_calendar/oauth-client" \
  -H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
  -H "Authorization: Bearer $SERVER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"client_id": "...", "client_secret": "..."}'
```

The redirect URI to add at the provider is `$STREAM_ACCELERATION_URL/v1/agents/connectors/oauth/callback`.

## Going further

- [Catalog](https://getstream.io/agents/docs/connectors/catalog/): Every built-in connector, what it does, and how it signs in.
- [User connection](https://getstream.io/agents/docs/connectors/each-user-account/): Let each user connect their own account, from the dashboard or your own app.
- [Troubleshooting](https://getstream.io/agents/docs/connectors/troubleshooting/): Errors you may see, why, and what to do.

---

For the most recent version of this documentation, visit [https://getstream.io/agents/docs/connectors/sign-in/](https://getstream.io/agents/docs/connectors/sign-in/).