Skip to content
Scalekit Docs
Talk to an Engineer Dashboard

Authorize a user

Generate an authorization link, send it to your user, and confirm their connected account is active before your agent executes tools.

Once a connection is configured, your users need to grant your agent access to their account. This happens once per user per connection. Scalekit stores their tokens and keeps them fresh automatically.

The flow is:

  1. Create a connected account for the user
  2. Generate an authorization link and send it to the user
  3. The user completes the OAuth consent screen
  4. The connected account becomes ACTIVE. Your agent can now execute tools.
Section titled “Create a connected account and generate a link”

These samples use actions, set up as in the Quickstart. The first block shows the setup; later blocks reuse it.

import os
from dotenv import load_dotenv
from scalekit import ScalekitClient
from scalekit.common.exceptions import ScalekitServerException
load_dotenv()
scalekit_client = ScalekitClient(
env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
client_id=os.environ["SCALEKIT_CLIENT_ID"],
client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
)
actions = scalekit_client.actions
try:
# Create or retrieve the connected account for this user
response = actions.get_or_create_connected_account(
connection_name="github-connect",
identifier="user_123" # your app's unique user ID
)
connected_account = response.connected_account
# Generate the authorization link if the account is not yet active
if connected_account.status != "ACTIVE":
link_response = actions.get_authorization_link(
connection_name="github-connect",
identifier="user_123"
)
auth_url = link_response.link
# Redirect or send auth_url to the user
except ScalekitServerException as e:
# For example, the connection name doesn't match the dashboard
print("Scalekit error:", e.error_code, e.message)

By default, the link expires five minutes after you create it. The response’s expiry field gives the exact time, so create the link when you’re ready to send it, and create a new one if it expires.

How you deliver the link depends on your application:

  • Web app: redirect the user to auth_url directly if they’re in an active browser session
  • Email or notification: send the link when the user isn’t actively in your app, or when connecting at their own pace is acceptable
  • In-app prompt: show a button (“Connect GitHub”) when you want to prompt connection at a specific moment in the user’s workflow

Once the user opens the link and approves the OAuth consent screen, Scalekit exchanges the authorization code for tokens and marks the connected account ACTIVE. You do not need to handle the OAuth callback yourself.

To learn when the user has finished, listen for account events: a connected_account.status_updated event with status ACTIVE arrives when the account activates. Or check the status again with get_connected_account_details in Python or getConnectedAccount in Node.js.

Check the connected account status before executing tools. Tokens can expire or be revoked, so generate a new authorization link using the same flow when that happens.

response = actions.get_or_create_connected_account(
connection_name="github-connect",
identifier="user_123"
)
connected_account = response.connected_account
# ACTIVE: ready for tool calls
# PENDING_AUTH: the user hasn't completed authorization yet
# PENDING_VERIFICATION: authorized, but user verification is still pending
# EXPIRED: tokens expired or were revoked; the user must authorize again
# DISCONNECTED: the account was disconnected
if connected_account.status != "ACTIVE":
link_response = actions.get_authorization_link(
connection_name="github-connect",
identifier="user_123"
)
# Redirect or send link_response.link to the user

user_verify_url is required when user_verify_mode is b2b

Section titled “user_verify_url is required when user_verify_mode is b2b”

The environment uses the Custom user verifier mode, and the link request didn’t include user_verify_url. The request fails with a 400. Pass user_verify_url and state as shown in Verify users, or switch to Scalekit users only for internal testing.

The user didn’t finish authorizing, or the link expired before they opened it. Create a new link and send it again.

Find the error message or the account status on Troubleshoot connection and OAuth errors. It covers each connected-account status, the errors on Scalekit’s connection page, OAuth app misconfiguration and provider-specific errors.

API reference

The endpoints this page's code calls, with every field and the SDK method for each: