Guide

Customer OAuth

Understand the current customer-authorization boundary before designing provider onboarding.

On this page

Prerequisites
Start authorization
Expected result
Errors
Next step

Prerequisites

Create a test project and review the live provider catalogue. Google and Microsoft currently require your own OAuth client and secret; configure them in Provider Apps with the exact callback URI shown by Moira Connect. Customer OAuth remains Foundation Only for providers whose connector, partner approval, callback configuration, or entitlement is not ready.

Moira Connect normalizes durable account and event contracts, but provider authorization remains provider-specific. WhatsApp QR, Telegram QR or phone challenges, and LinkedIn OAuth have different consent, expiry, and capability rules.

Start authorization

Create a Hosted Connect session with the provider and authentication mode shown as available for the selected project. Keep OAuth client secrets on the server and allowlist the exact success redirect origin.

json

{
  "provider": "linkedin",
  "external_reference": "customer-42",
  "auth_mode": "oauth"
}

Expected result

An entitled OAuth provider returns through the server callback, consumes its single-use state, and updates the hosted session. A foundation-only provider remains clearly unavailable; it does not return a simulated success.

Errors

hosted_connect_session_expired means the short-lived authorization link must be replaced.
capability_not_granted means partner approval or project entitlement is absent.
provider_unavailable means the registry or an operator kill switch blocks connection.

Next step

Read account health and capability state, then enable only the operations actually granted for that account.