Connected accounts

#Deployed API & provider availability

Connected accounts are separate from Project Authentication. Project Authentication proves who an application user is; connected accounts hold permission to act on an external resource such as a calendar or Drive file. An Access Identity owns these accounts and the user's permission inventory. A Client Access grants one Client App the approved subset of Agent Tools and resources.

#Client App connection flow

1. 1
   Register the Client App

   In Agent Access, associate your Service with the Project and configure its exact Return URLs, Agent Tools, and resources.

2. 2
   Create a Link from your backend

   Send the signed-in partner's externalUserId, or a verified Project Authentication access token, with the requested Tools and your stored state. Redirect the browser to the returned connectUrl.

3. 3
   Verify the Access Identity and review Tools

   The user signs in to HALO and reviews required and optional Tools. HALO reuses existing Connected Account permissions only where they already cover the request; missing scopes or exact Drive files require provider authorization or file selection.

4. 4
   Approve the final handoff

   Final confirmation creates Client Access and Tool Grants. Validate the returned state and stored session ID, then fetch the Link server-side. Store clientAccessId only when the session is completed.

5. 5
   Execute or revoke approved access

   Call the declared Tool with clientAccessId. Writes require an input-bound execution approval. Revocation blocks future Tool calls while preserving audit history.

#Portable identity & email linking

Portable Access is available independently of your signup service. An app can keep its own members and connect them to HALO Access Identities through the Link flow. Identity OAuth Clients are for Project user identity; they do not grant Calendar or Drive Tool permissions.

External-user Links can opt into same-email association with a verified partner email and a real, recent consent receipt. HALO requires a signed-in owner with the same trimmed, lowercased email and explicit association approval. Email equality alone never links accounts. Association approval and final Tool consent are separate steps.

#Token custody

#Retired routes & provider limits

The former /api/v1/memory/projects/:projectKey/oauth, scope connection routes, and Memory OAuth callback return HTTP 410 with LEGACY_APP_CONNECT_RETIRED. Use Agent Access for new integrations and migrate existing project-owned connection flows.

A redirect hook cannot manufacture an upstream API permission. Services such as DoorDash that expose no suitable public OAuth/API contract remain partnership-required catalog entries.