OAuth connections store encrypted upstream tokens outside Agent inputs and workflow logs. The callback uses single-use state to bind the provider response to the authorization that started it.
List available providers and connections
GET /v1/applications/{appId}/oauth-connections returns provider metadata and connected subjects without tokens.
Start authorization
POST /v1/applications/{appId}/oauth-connections/{connectionId}/authorize accepts an optional subject and redirectUri, then returns the URL the account owner opens.
Finish at the provider
The provider redirects to /v1/oauth/callback. The callback needs the single-use state, not an AgentMQ session.
Revoke when access is no longer needed
DELETE /v1/applications/{appId}/oauth-connections/{connectionId}?subject=<subject> revokes the selected local and upstream grant.
Verify
List connections again and confirm the subject, scopes, status, and expiry. No access or refresh token appears in the response.