Skip to main content
Wire an OAuth connector end to end so tools can call an authenticated third-party API. A connector is an OAuth connection to an outside app. A connector provider is a descriptor — pure data declaring the provider’s OAuth endpoints and sub-services; the connector engine drives the authorize flow, stores the tokens, and launches the provider’s sub-service MCP servers. This guide covers the platform flow — loading a provider, running the connect flow, and using the connection. Provider-specific setup (the OAuth app to register, the client-credential environment variables) lives in that provider’s own repository README.

​
Load a connector provider

A provider is registered from the manifest’s connectors: list — the server registers each descriptor there at boot and on every reload, with no module import and no lifecycle_modules entry. There are two ways to add one:
  • Install it from the marketplace. Installing a connector listing patches its descriptor into the manifest connectors: list for you (and takes the client credentials up front):
  • Add the descriptor by hand. Put a connectors: entry in the manifest — the same ProviderDescriptor shape a listing ships:
    manifest.yml
Set the provider’s client-credential environment variables on the server process — each provider names them in its README (the client_id_env / client_secret_env above). With the descriptor in the manifest and the credentials present, list the available providers:

​
Run the connect flow

1

Start a connection

Name the provider, give the connection a unique alias, and enable one or more sub-services. The command prints the authorize URL.
2

Authorize

Open the printed authorize URL in a browser and grant consent. The provider redirects back to the server’s callback, which exchanges the code and stores the tokens under the alias.
3

Confirm the connection

List the installed connections (no secrets are printed).
Change which sub-services a connection exposes with tai connectors sub-services, re-authorize with tai connectors reconnect, and remove a connection with tai connectors disconnect.
A connector provider carries no OAuth, probe, or launch code — it is pure descriptor data. The connector engine drives the whole flow generically from that descriptor.

​
See also

  • Connectors — what a connector is and how the engine drives it.
  • Plugins — the shipped connector providers and their repositories.
  • CLI reference — the full tai connectors surface.