Visit us at ReInvent How to find us →

Add a verified connector

Last validated:

Aperture's Add connector menu provides pre-configured defaults for verified providers, including endpoint URLs, authentication types, and scopes. Use the verified connectors catalog to find a provider's defaults, setup requirements, and upstream documentation.

All verified connectors use per-user OAuth. Each user authorizes access after an admin configures the connector and grants access. The credential setup depends on the provider:

  • Dynamic client registration (oauth2_dcr): Aperture registers an OAuth client automatically. You do not create an OAuth application or supply client credentials.
  • Pre-registered Aperture OAuth clients: Some providers, such as Gmail, Google Calendar, and Google Drive, use oauth2_authorization_code with an OAuth client that Aperture pre-registers. You do not need your own client ID or secret. The catalog's QuickSetup column identifies these providers.
  • Manual OAuth setup: Other oauth2_authorization_code providers require an OAuth application, a registered callback URL, and a client ID. Supply a client secret if the provider requires one.

The catalog marks the first two options as QuickSetup. For these providers, skip Step 1 and Step 2's manual credential fields. Complete any provider-side prerequisites in the catalog, such as enabling MCP or obtaining workspace admin approval. QuickSetup does not replace connector grants or per-user authorization.

Prerequisites

Before you begin, you need the following:

  • Admin access to the Aperture configuration. Refer to Get started with connectors.
  • If you use manual OAuth setup, permission to create an OAuth application in the provider's developer or admin console. QuickSetup providers do not require this permission.

Step 1: Create the OAuth application at the provider

Complete this step only for manual OAuth setup. Configure the OAuth application on the provider first, using the catalog's setup guidance. The provider's redirect URI must match the callback URL in Aperture.

If you choose to use your own OAuth client for a Google Workspace connector instead of the pre-registered Aperture client, the following requirement applies:

If you use your own OAuth client for a Google Workspace connector, create it in a Google Cloud project enrolled in Google's Workspace Developer Preview Program. Credentials from a project that is not enrolled fail to authorize. With Aperture's pre-registered client, you can use QuickSetup without creating a project or OAuth client.

To create your OAuth application:

  1. Create an OAuth application in the provider's developer or admin console.
  2. Register https://<aperture-hostname>/aperture/auth/<connector-id>/callback as the redirect URI. In Step 2, Aperture defaults the connector ID to the provider name, such as Salesforce. Use the same ID here. To choose a custom ID first, complete Step 2 before registering the callback URL.
  3. Grant the application the scopes your users need. The picker pre-fills each provider's default scopes as editable chips, which you can add to or remove.
  4. Note the client ID. If the application uses a client secret, note that too. You enter these values in Aperture in the next step.

Step 2: Add the connector from the picker

For authorization-code verified providers, Aperture pre-fills any auth_params required for refresh tokens (for example, Google's {"access_type": "offline", "prompt": "consent"}). You normally do not need to change these. Refer to Connector authentication for auth_params details.

Add and configure the connector:

  1. Open the Aperture admin dashboard and go to Administration > Connectors.

  2. Choose Add connector and select a verified provider from the list. Choose Custom connector to configure a provider that is not in the registry. Aperture pre-fills the fields available for that provider and sets the connector ID to the provider name. Dynamic client registration connectors, including Atlassian, Notion, and Linear, do not pre-fill authorization or token URLs.
  3. Confirm or edit the connector ID. For manual OAuth setup, enter your client ID and your client secret if required. PKCE-only applications can omit the secret. The connector ID must match the value in your callback URL. For a QuickSetup connector with a pre-filled client ID, keep that client ID and leave the client secret blank.
  4. Review the provider-specific setup note and upstream documentation link in the form.
  5. Complete any required provider-side setup. For manual OAuth setup, copy the callback URL shown in the note to the provider's app configuration.
  6. Select Add connector.

Aperture uses the saved configuration, not the registry defaults, at runtime. Refer to the verified connectors catalog for default URLs, scopes, and provider requirements.

Step 3: Grant access

Verified connectors are deny-by-default like all connectors. Add a connectors grant so users can reach the connector's tools. Refer to grant access to MCP tools.

Step 4: Have users authorize

To hand off authorization to users:

  1. Open Connectors in the Aperture Chat portal to confirm the connector is available to the intended users.
  2. Send each user who has access the Use a connector instructions to complete their own authorization in Chat.

Refer to these topics for more information: