---
title: "Connect an OAuth account"
description: "Authorize, inspect, and revoke application or end-user OAuth connections."
image: "https://help.agent.mq/og.svg"
---

> Documentation Index
> Fetch the complete documentation index at: https://help.agent.mq/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect an OAuth account

OAuth connections store encrypted upstream tokens outside Agent inputs and workflow logs. The callback uses single-use state to bind the provider response to the authorization that started it.

1. **List available providers and connections**

   `GET /v1/applications/{appId}/oauth-connections` returns provider metadata and connected subjects without tokens.
2. **Start authorization**

   `POST /v1/applications/{appId}/oauth-connections/{connectionId}/authorize` accepts an optional `subject` and `redirectUri`, then returns the URL the account owner opens.
3. **Finish at the provider**

   The provider redirects to `/v1/oauth/callback`. The callback needs the single-use state, not an AgentMQ session.
4. **Revoke when access is no longer needed**

   `DELETE /v1/applications/{appId}/oauth-connections/{connectionId}?subject=<subject>` revokes the selected local and upstream grant.

## Verify

List connections again and confirm the subject, scopes, status, and expiry. No access or refresh token appears in the response.

## Next steps

- [Consumer controls](/approval/consumer-controls)
- [Security and contact](/help/security)

Source: https://help.agent.mq/build/oauth-connections/index.mdx