# OAuth apps

Understand the registration used to authorize Credentials, its Workspace scope, and the difference between app secrets and account tokens.

Last updated: 2026-10-23

An OAuth app is the app registration through which a Credential requests access to an account on
another service. It identifies the app asking for access and supplies the configuration needed for
authorization.

Registering an app does not authorize a customer's account. That happens when a person completes
authorization for a [Credential](/configuration/credentials).

## Registration and account authorization

A custom OAuth app belongs to your Workspace. It can be used to authorize multiple Credentials,
including Credentials for different Environments and accounts.

For example, one custom registration can authorize a test account for a staging Credential and a
live account for a production Credential. Each Credential has its own authorization and matching
Secret; sharing the app registration does not share the account token.

Typenode distinguishes two kinds of OAuth app:

| Kind | Who manages the registration |
| --- | --- |
| Managed | Typenode |
| Custom | Your organisation, registered in your Workspace |

Ask your Agent to check the available managed and custom registrations before planning setup.
Managed apps use Typenode's registration and keep its client material out of your setup. Custom
apps let your organisation choose and maintain the registration.

## Choosing an app

See [Managed and custom OAuth apps](/integrations/managed-and-custom-oauth-apps) to compare registration ownership and the
available routes. The [Google reference](/integrations/providers/google) lists its enabled managed APIs,
exact allowed scopes and account-access conditions.

## A custom app's sensitive details

Custom setup uses the registration details supplied by the service, including its client ID and,
when required, client secret. The Agent prepares the registration; you supply the sensitive value
through Typenode's browser handoff.

An OAuth app's client secret and a Credential's access token have different purposes. The client
secret identifies the registered app during the OAuth exchange. The access token authorizes calls
to the account's data. Use the Credential's matching Secret in a Workflow, rather than the app's
client secret.

The client secret is encrypted in storage. See
[Sensitive data and handoffs](/agents/sensitive-data) for what that protection covers.

## OAuth scopes

OAuth scopes are defined by the outside service and requested for a Credential. Use the service's
exact scope names and request the access needed for the task.

Each Template Credential declares its own exact scope list. The scopes shown under an App are a
combined display of those requirements, not the default consent request for every account. Sharing
an app registration does not require all Credentials to request the same scopes. An empty list
requests no scopes; it does not expand to the app's allowed scope inventory.

A Typenode Scope limits an Access key or OAuth client acting inside Typenode. An OAuth scope
controls access requested from the outside service. Neither one grants the other.

## Changes can affect several Credentials

Because Credentials share an app registration, repairing or changing that registration can affect
more than one account authorization. Account reconnection alone cannot fix an invalid app client
secret or a registration rejected by the service.

When account access needs renewal, [manage the Credential](/configuration/credentials#refresh-and-reconnection). When the registration details are the
problem, repair your custom OAuth app or contact Typenode about a managed app. Review the
service's requirements before changing either.