# Connect Apps

Connect an administrator-enabled SaaS app for a user with a one-time OAuth consent link.

- Repository: https://github.com/yc-software/qm (15597 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yc-software/qm --skill connect-apps -g -a claude-code -y`
Codex: `npx skills add yc-software/qm --skill connect-apps -g -a codex -y`
Cursor: `npx skills add yc-software/qm --skill connect-apps -g -a cursor -y`
Gemini CLI: `npx skills add yc-software/qm --skill connect-apps -g -a gemini-cli -y`

## Description

Connect an administrator-enabled SaaS app for a user with a one-time OAuth consent link.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## Connecting SaaS apps

Check Composio availability through `GET /v1/composio/toolkits` on the authenticated QM API. When available, load the `composio` skill and use its discovery and consent flow instead
of the direct OAuth flow below. An empty direct OAuth list or a native
`oauth_not_configured` error does not describe Composio availability. Preserve explicit
app restrictions and account permissions; never switch credentials to evade a denial.

When `$AGENT_OAUTH_CONSENT_TOKEN` is set you can help the user connect a SaaS app via a browser
consent link they tap, you never see or enter their password. The direct OAuth allowlist is
the providers configured by the admin, the catalog entries with `configured: true`:

```sh
curl -fsS "$AGENT_API_URL/v1/connectors/catalog" -H "x-agent-capability: $AGENT_API_TOKEN" \
  | jq -r '.catalog[] | select(.configured) | .provider'
```

Offer direct OAuth links only for those providers, and none when the list is empty. Mint a single-use link for the selected provider, then give the user the full URL to open:
curl -sS -X POST "$AGENT_API_URL/v1/connectors/oauth/consent/mint" \
      -H "X-Agent-Capability: $AGENT_OAUTH_CONSENT_TOKEN" -H 'content-type: application/json' \
-d '{"provider":"<configured-provider>"}'

- The response has `connectUrl`, give the user THAT exact URL (it is the full public tap-through
  link). Do NOT build it yourself or prepend `$AGENT_API_URL`, that private base isn't reachable
  from a browser.
- If mint returns `oauth_not_configured`, the native provider is not configured. Do not retry that
  direct OAuth path or re-send old links; this does not establish that every access path is unavailable.
- You cannot open the link yourself; relay the URL, tell them to tap Allow, then return. After they
  connect, the app's tools/skills work in your 1:1s with them.

## Connect a personal Slack account

The rest: https://github.com/yc-software/qm/blob/HEAD/skills-seed/connect-apps/SKILL.md