Authentication and connect links

Managed or your own OAuth app

With managed auth, users sign in through Prompt TM's own OAuth app for that toolkit, where one is set up. With custom auth you register an OAuth app with the provider and paste its client id and secret. Your users then see your app's name on the consent screen.

Register this redirect URI in your OAuth app:

https://www.prompt-tm.com/api/v3/auth/callback

curl -X POST https://www.prompt-tm.com/api/v3/auth_configs \
  -H "x-api-key: $PROMPT_TM_KEY" -H "content-type: application/json" \
  -d '{ "toolkit": { "slug": "slack" },
        "auth_config": { "type": "use_custom_auth", "auth_scheme": "OAUTH2",
          "credentials": { "client_id": "...", "client_secret": "...", "scopes": ["chat:write", "channels:read"] } } }'

Connect links

POST /api/v3/connected_accounts/link returns a redirect_url on prompt-tm.com. The page shows the app and your project name, then sends the user to the provider (OAuth) or shows a form for the key. Links expire after one hour.

Pass callback_url to send the user back to your app afterwards. We append status=success or status=failed, connected_account_id and, on failure, error.

Keys you already have

If your app already holds a user's key, skip the link:

curl -X POST https://www.prompt-tm.com/api/v3/connected_accounts \
  -H "x-api-key: $PROMPT_TM_KEY" -H "content-type: application/json" \
  -d '{ "auth_config": { "id": "ac_..." }, "user_id": "alice",
        "connection": { "data": { "token": "github_pat_..." } } }'

We check the key with the app before saving it. A rejected key answers 400 and the account is FAILED.

Refresh and expiry

Before each call, an OAuth token that expires within a minute is refreshed. If the provider refuses, the account becomes EXPIRED and your webhook receives connected_account.expired. POST /api/v3/connected_accounts/{id}/refresh returns a new link for the same account.