Sign-in and OAuth clients
When Alice connects Google Calendar, Google shows her a consent screen that names the app asking for access. With your own OAuth client, it shows your app's name instead of Stream's.
How a connection signs in
A connector takes one or more kinds of sign-in. The Sign-in column of the catalog says which.
| Sign-in | When you use it |
|---|---|
| OAuth | A person signs in at the provider and allows access. Most connectors in the catalog |
| OAuth client credentials | The app signs in with a client id and secret instead of a person. Only salesforce takes it |
| Bearer token | You have a token from the provider, such as a GitHub personal access token |
| API key | Your own MCP server takes a key in a header, such as x-api-key |
| No authentication | A public server, such as a shop on Shopify or DeepWiki |
In the API, a connector's schemes and a connection's auth_scheme take values such as oauth2_code, oauth2_client_credentials, bearer, api_key and none.
Whose OAuth client
An OAuth sign-in needs a client registered at the provider. The Sign-in column of the catalog says which clients a connector takes:
| OAuth client | What you set up |
|---|---|
| Stream's client | Nothing. Stream registered the client at the provider |
| Registered at each consent | Nothing. Stream registers a client with the provider at each sign-in |
| Your own client | You register a client at the provider and give it to Stream |
We recommend starting with what needs no setup: Stream's client, or the one registered at each consent. Set your own client when your users should see your app's name on the consent screen, or when the connector takes only yours, such as linear_app.
Use your own OAuth client
Give the client to Stream
Register an OAuth client at the provider, then give its id and secret to Stream. The secret is read from stdin, never from an argument:
getstream agents connectors client set google_calendar --client-id 123.apps.googleusercontent.com --client-secret - < secret.txtRedirect URI (add it at the provider): https://accelerate-us-east4.gcp.stream-io-api.com/v1/agents/connectors/oauth/callback
Saved the OAuth client for google_calendarclient set replaces what was stored: a field you leave out is removed. We encrypt the secret and never show it again, so give it each time.
Add the redirect URI
Add that redirect URI to the client at the provider.
Connect as usual
getstream agents connections create google_calendar --label calendar opens Google's consent for your client in the browser, and the CLI prints Connected once you allow access.
To go back to Stream's client:
getstream agents connectors client remove google_calendarConnections made with your client then need a reconnect. A client Stream keeps for your app can't be removed.
In the Dashboard
In the Stream Dashboard, go to Agents > Library > Connectors and open Google Calendar. The OAuth client section shows the Redirect URI to add at the provider. Click Set OAuth client, type the Client ID and the Client secret, then click Save client.
The section then shows your Client ID, with Replace and Remove. As with the CLI, a save replaces what was stored, so type each secret every time.
With the API
Your server sets the same client with one call:
curl -X PUT "$STREAM_ACCELERATION_URL/v1/agents/connectors/google_calendar/oauth-client" \
-H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
-H "Authorization: Bearer $SERVER_TOKEN" \
-H "Content-Type: application/json" \
-d '{"client_id": "...", "client_secret": "..."}'The redirect URI to add at the provider is $STREAM_ACCELERATION_URL/v1/agents/connectors/oauth/callback.