Skip to content
ajan.io

Docs menu

On this page

Bring Your Own OAuth Client

Set up custom OAuth applications for integrations, assign clients to your workspace or user groups, and control scopes, tenant policies, and branding.

How Custom OAuth Works

When you configure a custom OAuth client, ajan routes new authentication flows through the OAuth application assigned to each user instead of the default ajan client. A client for the entire workspace applies by default, while group clients apply to members of the assigned groups. This means:

  • Your branding (custom name and logo) appears in consent screens
  • Your tenant policies control user access and admin consent requirements
  • Your rate limits apply to API calls made by your users
  • Your user groups can authenticate through separate OAuth clients

Create OAuth App at Provider

Register a new OAuth application in your provider's developer portal (Google Cloud Console, Microsoft Azure, etc.).

Required Configuration:

  • Copy the exact redirect URL from ajan's integration settings
  • Select all required scopes shown in ajan for that integration
  • Configure any tenant-specific settings (admin consent, allowlisting)

Gather Credentials

Note down the following from your OAuth app:

  • Client ID (always required)
  • Client secret (required for most integrations)
  • Tenant ID (optional, shown for Microsoft integrations only)

Configure in ajan

Go to Workspace settings → Integrations, select the integration, and scroll to Bring your own OAuth Client.

Click Add another OAuth client when the integration includes a ajan client. If the integration requires your own client, click Configure your OAuth client to use this integration.

In the configuration dialog, copy the Redirect URL into your OAuth app and review the Scopes section. Make sure all listed scopes are enabled in your OAuth app — missing scopes will cause an insufficient scopes error. You can copy all scopes at once using the copy button.

For integrations with action-level permissions, we recommend keeping Sync scopes with enabled actions turned on by default. ajan then requests the auth scopes plus the scopes required by enabled or shared actions, keeping requested scopes aligned with the actions your workspace can use. Learn more in Manage Action-Level Scopes.

Optionally add a descriptive Client name. Under Access, choose Entire workspace or Groups. Enter your Client ID and Client secret (and Tenant ID if prompted for Microsoft integrations). If the integration shows extra connection fields, set those under OAuth connection details, then click Save and confirm the change.

Select the saved client from the client list and confirm the switch to activate it.

Test Authentication

Have a user connect their account to verify:

  • Consent screen shows your client
  • Required scopes are granted
  • Data access works as expected through actions

Assign OAuth Clients to User Groups

Use group access when different parts of your organization need separate OAuth applications for the same integration. For example, assign one client to a subsidiary with its own Microsoft Entra tenant, or use a separate client when a department needs a different approved scope set. The client for your entire workspace remains the default for everyone who is not covered by a group client.

Add another custom client

Click Add another OAuth client. Optionally give the client a descriptive name so you can identify it in the client list.

Manage client access

In the Access section, select Groups, then click Manage to choose the user group that should use this client.

Add credentials

Enter the Client ID, Client secret, and any fields required by the provider. Click Save and confirm the change. Select the saved client from the client list and confirm the switch to activate it.

Integration Settings Interface

The configuration dialog contains the following sections:

A read-only field displaying the redirect URL your OAuth app must use. Click the copy button to copy it exactly. The URL format is:

    https://app.ajan.com/api/integrations/{integration-id}/callback

Displays the OAuth scopes required for the integration to function correctly. For example, Jira requires scopes like read:jira-work, write:jira-work, read:jira-user, offline_access, and manage:jira-configuration.

  • Copy: Copy all scopes to your clipboard for pasting into your OAuth app configuration.
  • Edit: Switch to edit mode to customize scopes in a text area (advanced use cases only).
  • Reset to default scopes: Restore the original scope list if you have modified it.

For integrations with action-level permissions, keep Sync scopes with enabled actions turned on unless you intentionally want to manage a fixed scope list yourself. This is the recommended default because ajan can keep OAuth scopes in sync with enabled and shared actions.

Enter your OAuth application credentials:

  • Client name (optional): A descriptive name that identifies the client in ajan
  • Client ID (required): Your app's public identifier
  • Client secret (required for most integrations): Your app's private key, stored encrypted
  • Tenant ID (Microsoft integrations only, optional): Your Azure AD tenant identifier
  • OAuth connection details (when shown): extra fields for that client, each marked Optional

OAuth connection details

Some integrations ask for extra connection fields, such as an instance URL, subdomain, or store domain. Save those values as a workspace default so members skip that prompt when they connect.

  • On the ajan client card, click Configure when those fields appear. On dedicated deployments, that card is labeled Global client.
  • On a custom client, the same fields appear in the configuration dialog and apply only to that client. A ajan-client default does not apply to a custom-client connection.
  • Leave a field empty if members should type it when they connect. Enter a value to set the default, for example https://acme.service-now.com. Each field is marked Optional.

If every extra field already has a saved value, members go straight to sign-in. If any field is empty, they still enter it. Workspace admins who see that dialog get a banner with a link back to the integration settings page.

Microsoft Tenant ID stays a separate field in the credentials dialog. Existing connections keep their stored values. New connections and reauthorization use the current defaults.

Manage Custom OAuth Clients

Each card shows the client name, access type, scope mode, and active status.

  • Select an inactive client card to activate it.
  • Select an active custom client card to deactivate it.
  • Click the settings icon to edit the client.
  • Open the client settings and click Delete OAuth client credentials to remove it.
  • Select ajan client to use the managed client for new connections. This deactivates all custom clients.

You can keep several group clients active when their members do not overlap. Only one client for the entire workspace can be active for an integration.

Common Configuration Errors

Cause: Redirect URL doesn't match exactly between ajan and your OAuth app

Solution:

  • Copy the redirect URL from ajan exactly
  • Check for trailing slashes or protocol mismatches
  • Verify you're configuring the correct environment

Cause: Client ID or Client secret is incorrect

Solution:

  • Double-check credentials from your OAuth app
  • Ensure no extra spaces or characters
  • Verify the client is enabled in your provider's console

Cause: Admin consent required but not granted

Solution:

  • Grant admin consent in your tenant settings
  • Enable user consent if appropriate for your organization
  • Check tenant allowlisting requirements

Cause: Missing required scopes in your OAuth app

Solution:

  • Add all scopes shown in ajan to your OAuth app
  • Users may need to reconnect after adding scopes
  • Verify scope names match exactly (case-sensitive)

Cause: At least one user belongs to a group covered by another active OAuth client.

Solution:

  • Review the groups assigned to both clients
  • Remove the overlapping group assignment or membership
  • Activate the client again

Integrations Requiring Your Own OAuth Client

Some of our integrations can only be used when providing your own OAuth client. Details on how to connect them with ajan are described in this section.

UiPath

UiPath has no ajan-managed OAuth client. External applications are registered per Automation Cloud organization, so a UiPath admin must create a confidential application in your organization before users can connect Orchestrator.

In UiPath

  1. Open organization Admin → External applications → OAuth apps.
  2. Click Add application and choose Confidential application.
  3. Under Orchestrator, grant the scopes shown in ajan on User Scope(s) only. Leave Application Scope(s) empty.
  4. Paste the ajan Redirect URL, then save.
  5. Copy the Application ID and app secret.

In ajan

  1. Open UiPath under Workspace settings → Integrations.
  2. Click Configure your OAuth client to use this integration.
  3. Paste the Application ID and app secret, save, and activate the client.

Required authentication fields

  • UiPath Cloud URL (organization and tenant)

Save UiPath Cloud URL as a workspace default in OAuth connection details, for example https://cloud.uipath.com/acme/DefaultTenant/orchestrator_/. If you leave it empty, the connecting member pastes a URL like that, or enters org / org/tenant. ajan runs a user-delegated OAuth flow with that user's Orchestrator permissions.

Full guides

UiPath Integration Requirements

Only UiPath Automation Cloud. Automation Suite and other self-hosted hosts are not supported.

External OAuth apps are registered per UiPath organization. A client from one organization cannot cover every ajan customer, so each organization creates its own confidential application.

Yes.

  • A UiPath admin creates the external application.
  • Scopes go under User Scope(s) for Orchestrator, not Application Scope(s).
  • Connecting users need Orchestrator access to the folders and processes they use in ajan.

Separate integration. It uses an Open API token (API key), not this OAuth client.

See the UiPath setup guide for token setup and least-privilege guidance.

ServiceNow

To enable this integration for your workspace, your ServiceNow system administrator must create an OAuth client, in the form of an application registry in ServiceNow, following this documentation.

\ Required authentication fields

  • Provide ServiceNow Subdomain

Save the ServiceNow subdomain as a workspace default in OAuth connection details. If you leave it empty, members enter it when they connect.

ServiceNow Integration Requirements

Only Cloud-hosted accounts are currently supported.

A paid ServiceNow account is required to create an application registry. View ServiceNow's plans here.

Yes. To connect by OAuth, your systems administrator should set up the right configuration within your instance to connect any user using an OAuth connection. E.g. all users need the oauth\_user role to be able to connect.  Learn more about ServiceNow's groups and permissions

Yes. ServiceNow implements rate limiting to prevent excessive API usage. System administrators can configure rules that restrict the number of inbound REST API requests processed per hour. Learn more about ServiceNow's usage limits.

Shopify Admin

Shopify Admin has no ajan managed OAuth app. A workspace admin creates an app in the Shopify Dev Dashboard and pastes the Client ID and Client Secret into ajan. Connections use application-level permissions: ajan acts with the app's Admin API scopes, not the personal Shopify role of the person who installed it.

Follow the full walkthrough in the Shopify Admin setup guide.

Required authentication fields

  • Store domain (a custom domain, a *.myshopify.com domain, or the store handle)

Save the store domain as a workspace default in OAuth connection details, for example acme-store.myshopify.com. If you leave it empty, members enter it when they connect.

Copy from ajan into the Shopify app

  • Redirect URL from the Shopify Admin OAuth client dialog
  • Admin API scopes shown in that dialog (or the full list in the setup guide)

Copy from Shopify into ajan

  • Client ID
  • Client secret

Snowflake

Configuring your own OAuth client for Snowflake gives you control over authentication policies, token validity periods, and IP allowlisting within your Snowflake environment.

Required Information:

  • OAuth Redirect URL: Copy this from ajan's Snowflake integration settings page
  • Client ID: Generated by Snowflake after creating the security integration
  • Client Secret: Generated by Snowflake after creating the security integration
  • Authorization URL: Your Snowflake account's authorization endpoint

The Redirect URL from ajan must be provided in Snowflake, while the Client ID, Client Secret, and Authorization URL from Snowflake must be entered into ajan's integration settings.

Setup Guide

Create Integration in ajan

In your ajan workspace, create your new Snowflake integration, and set up a custom OAuth Client.

  1. Navigate to Integrations in ajan
  2. Click "Add Integration" and select "Start from Scratch"
  3. Fill in your preferred name and description for your new Snowflake integration
  4. Click "Create"
  5. Authentication Type: Select "OAuth 2.0" from the dropdown
  6. Authentication fields: Leave blank
  7. OAuth Configuration: Save your OAuth Redirect URL

Create Security Integration in Snowflake

In Snowflake, select your workspace, and create a new security integration.

  1. Create a new .sql file, and paste the following query:
sql
        CREATE SECURITY INTEGRATION <integration_name>
          TYPE = OAUTH
          ENABLED = TRUE
          OAUTH_CLIENT = CUSTOM
          OAUTH_CLIENT_TYPE = CONFIDENTIAL
          OAUTH_REDIRECT_URI = '<your_redirect_uri>'
          OAUTH_ISSUE_REFRESH_TOKENS = TRUE
          OAUTH_REFRESH_TOKEN_VALIDITY = 86400;
  1. Replace ` with a descriptive name and ` with the OAuth Redirect URL from Step 1.
  2. Run the query to create your new security integration in Snowflake. Note: Adjust your OAUTH_REFRESH_TOKEN_VALIDITY value based on your security policies.

Retrieve Client ID and Client Secret

  1. Within the same workspace, run the following query:
sql
        SELECT SYSTEM$SHOW_OAUTH_CLIENT_SECRETS('<integration_name>');
  1. Replace `` with the name you gave your security integration in the previous step.
  2. Save your Client ID and Client Secret. Store these credentials securely as they provide access to your Snowflake account.

Retrieve Account URL from Snowflake

  1. Click on your account name in the bottom left corner of your Snowflake application
  2. Under the Account Section, click on "View Account Details"
  3. Copy your Account URL

Configure Integration Settings in ajan

  1. Add your Client ID and Client Secret from Step 3 in the respective input fields of your new ajan integration
  2. In the following sections:
    • Authorization URL
    • Access Token URL
    • Refresh Token URL

Replace only https://example.com with your Snowflake Account URL from Step 4.

Example:

        https://example.com/oauth/authorize

Becomes:

        https://<your-snowflake-account-url>/oauth/authorize
  1. Click Save

Test the Connection

Click "Add Connection" in your Snowflake integration.

  • You should be directed to the Snowflake Authorization screen
  • Log into your Snowflake account

You have now successfully set up your own OAuth Snowflake integration!