Authorizing an OAuth integration and how the flow completes

Connecting an OAuth-based app runs a real per-user authorization flow. HIIE never exposes the underlying Composio key to your browser, and the whole exchange happens through server-side routes.

The flow, step by step

When you connect an OAuth app from the Browse tab:

1. Your browser posts the connect request to a server-side route. The Composio key stays on the server and is never sent to the browser.
2. The server returns a redirect URL. HIIE opens it so you can authorize the app with the provider.
3. After you authorize, HIIE polls the connection status until it resolves.

How it completes

The connection is polled until its status becomes ACTIVE, FAILED, or EXPIRED:

• ACTIVE — the connection succeeded and the app is ready to use. It appears in your Connected tab and its tools become available to Camelia.
• FAILED — the authorization did not complete; you can try connecting again.
• EXPIRED — the authorization window lapsed before it finished.

After it's active

Once active, Camelia can use the integration's tools. Read actions run immediately so she can answer questions, while write actions raise an approval popup before they run, unless you've turned on auto-approval in your settings.

Privacy note

Throughout this flow, the resolved Composio key is never returned to your browser or logged. You authorize the provider directly, and HIIE coordinates the exchange server-side.