Manage OAuth credentials and authorized thunks
Many business systems let other applications in through OAuth: you register Thunk.AI as an application with the system, and the system hands out access tokens. Thunk.AI keeps the details of each of those registrations as an OAuth credential, which your connections then use to sign in. And when a thunk acts on your behalf using your own sign-in, that permission is listed so you can see it and take it back.
Both live in your account settings, under Personal Resource Environment:
Credentials — the OAuth credentials your connections use.
Authorized Thunks — the thunks you have allowed to use your credentials.
For adding connections themselves, see Connections to Business Applications and Connecting to External Systems and Tools.
OAuth credentials
Add a credential
Open your account settings, then Personal Resource Environment → Credentials.
Choose Add Credentials.
In Configure OAuth Credential, give the credential a Credential Name and, optionally, a Description, and save.
Select the new credential and fill in its settings (below). Each field saves as you edit it.
Credential settings
The values come from the application you registered with the other system. Its OAuth or developer documentation lists them.
Setting | What to enter |
Grant Type | Authorization Code (User Authorization) when a person signs in and approves access. Client Credentials (Machine-to-Machine) when Thunk.AI signs in as the application itself, with no person involved. |
Authorization Endpoint | The system's sign-in and consent page. Not used for Client Credentials. |
Consent Prompt | Enabled (the default) asks the system to show the consent screen each time, so it issues a fresh refresh token. Choose Disabled for systems that only accept consent granted by an administrator. |
Token Endpoint | Where Thunk.AI exchanges a sign-in for an access token. |
Registration Endpoint (Optional) | For systems that support dynamic client registration. Leave Client ID empty and Thunk.AI registers itself automatically. |
Client ID | The ID of the application you registered. |
Client Secret | The application's secret. Required for Client Credentials. Public clients that use PKCE can leave it empty. |
Scopes | The permissions to request, separated by commas. Request only what your thunks need. |
Credential Encoding | How the client ID and secret are encoded when Thunk.AI asks for a token. Keep the default, RFC 6749, unless the system requires RFC 2617 (for example SAP BTP and some older servers). |
For the Authorization Code grant, the credential shows an OAuth Callback URL. Copy it into your application's redirect (callback) URI setting in the other system — sign-in fails if the two don't match.
Use a credential in a connection
When you add or edit a connection that signs in with OAuth, choose OAuth Credentials as its authentication method and pick the credential. One credential can serve several connections to the same system.
Delete a credential
Select the credential and choose Delete. Any connection that uses it stops working, so move those connections to another credential first.
Authorized thunks
When a thunk needs to act as you in another system — read your mailbox, update records under your name — it asks you to authorize it with your own sign-in. Authorized Thunks lists every thunk you have authorized and the connections each one can use.
If you have never authorized a thunk, the tab says No authorized thunks.
Review an authorization
Select a thunk to see the connections it can use with your credentials. Select a connection to see:
Credential owner — whose credential the authorization uses.
Grant type, Authorization endpoint, and Token endpoint.
Requested scopes and Granted scopes — what the thunk asked for, and what the other system actually allowed.
Authorized — when you granted it.
When the thunk has an end-user chat, Open end user UI takes you to it.
Authorizations granted before authorizations were tracked per thunk are grouped as Shared across thunks and marked Legacy. They apply to every thunk you use.
Revoke an authorization
To remove one connection, select it and choose Revoke.
To remove everything a thunk can do with your credentials, choose Revoke all for that thunk.
The thunk can no longer act as you in those systems. If it needs the connection again, it asks you to authorize it again.
Review this list from time to time, and revoke anything you no longer use — especially authorizations for thunks you have stopped working with.