Authorize a user
Generate an authorization link, send it to your user, and confirm their connected account is active before your agent executes tools.
Once a connection is configured, your users need to grant your agent access to their account. This happens once per user per connection. Scalekit stores their tokens and keeps them fresh automatically.
The flow is:
- Create a connected account for the user
- Generate an authorization link and send it to the user
- The user completes the OAuth consent screen
- The connected account becomes
ACTIVE. Your agent can now execute tools.
Create a connected account and generate a link
Section titled “Create a connected account and generate a link”These samples use actions, set up as in the Quickstart. The first block shows the setup; later blocks reuse it.
import os
from dotenv import load_dotenvfrom scalekit import ScalekitClientfrom scalekit.common.exceptions import ScalekitServerException
load_dotenv()
scalekit_client = ScalekitClient( env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"], client_id=os.environ["SCALEKIT_CLIENT_ID"], client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],)actions = scalekit_client.actions
try: # Create or retrieve the connected account for this user response = actions.get_or_create_connected_account( connection_name="github-connect", identifier="user_123" # your app's unique user ID ) connected_account = response.connected_account
# Generate the authorization link if the account is not yet active if connected_account.status != "ACTIVE": link_response = actions.get_authorization_link( connection_name="github-connect", identifier="user_123" ) auth_url = link_response.link # Redirect or send auth_url to the userexcept ScalekitServerException as e: # For example, the connection name doesn't match the dashboard print("Scalekit error:", e.error_code, e.message)import 'dotenv/config';import { ConnectorStatus, ScalekitClient, ScalekitServerException } from '@scalekit-sdk/node';
const scalekit = new ScalekitClient( process.env.SCALEKIT_ENVIRONMENT_URL!, process.env.SCALEKIT_CLIENT_ID!, process.env.SCALEKIT_CLIENT_SECRET!,);const actions = scalekit.actions;
try { // Create or retrieve the connected account for this user const response = await actions.getOrCreateConnectedAccount({ connectionName: 'github-connect', identifier: 'user_123', // your app's unique user ID });
const connectedAccount = response.connectedAccount;
// Generate the authorization link if the account is not yet active if (connectedAccount?.status !== ConnectorStatus.ACTIVE) { const linkResponse = await actions.getAuthorizationLink({ connectionName: 'github-connect', identifier: 'user_123', }); const authUrl = linkResponse.link; // Redirect or send authUrl to the user }} catch (err) { if (!(err instanceof ScalekitServerException)) throw err; // For example, the connection name doesn't match the dashboard console.error('Scalekit error:', err.errorCode, err.message);}By default, the link expires five minutes after you create it. The response’s expiry field gives the exact time, so create the link when you’re ready to send it, and create a new one if it expires.
Send the link to the user
Section titled “Send the link to the user”How you deliver the link depends on your application:
- Web app: redirect the user to
auth_urldirectly if they’re in an active browser session - Email or notification: send the link when the user isn’t actively in your app, or when connecting at their own pace is acceptable
- In-app prompt: show a button (“Connect GitHub”) when you want to prompt connection at a specific moment in the user’s workflow
Once the user opens the link and approves the OAuth consent screen, Scalekit exchanges the authorization code for tokens and marks the connected account ACTIVE. You do not need to handle the OAuth callback yourself.
To learn when the user has finished, listen for account events: a connected_account.status_updated event with status ACTIVE arrives when the account activates. Or check the status again with get_connected_account_details in Python or getConnectedAccount in Node.js.
Check status and re-authorize
Section titled “Check status and re-authorize”Check the connected account status before executing tools. Tokens can expire or be revoked, so generate a new authorization link using the same flow when that happens.
response = actions.get_or_create_connected_account( connection_name="github-connect", identifier="user_123")connected_account = response.connected_account# ACTIVE: ready for tool calls# PENDING_AUTH: the user hasn't completed authorization yet# PENDING_VERIFICATION: authorized, but user verification is still pending# EXPIRED: tokens expired or were revoked; the user must authorize again# DISCONNECTED: the account was disconnected
if connected_account.status != "ACTIVE": link_response = actions.get_authorization_link( connection_name="github-connect", identifier="user_123" ) # Redirect or send link_response.link to the userimport { ConnectorStatus } from '@scalekit-sdk/node';
const response = await actions.getOrCreateConnectedAccount({ connectionName: 'github-connect', identifier: 'user_123',});
const connectedAccount = response.connectedAccount;// ACTIVE: ready for tool calls// PENDING_AUTH: the user hasn't completed authorization yet// PENDING_VERIFICATION: authorized, but user verification is still pending// EXPIRED: tokens expired or were revoked; the user must authorize again// DISCONNECTED: the account was disconnected
if (connectedAccount?.status !== ConnectorStatus.ACTIVE) { const linkResponse = await actions.getAuthorizationLink({ connectionName: 'github-connect', identifier: 'user_123', }); // Redirect or send linkResponse.link to the user}Common problems
Section titled “Common problems”user_verify_url is required when user_verify_mode is b2b
Section titled “user_verify_url is required when user_verify_mode is b2b”The environment uses the Custom user verifier mode, and the link request didn’t include user_verify_url. The request fails with a 400. Pass user_verify_url and state as shown in Verify users, or switch to Scalekit users only for internal testing.
The account stays PENDING_AUTH
Section titled “The account stays PENDING_AUTH”The user didn’t finish authorizing, or the link expired before they opened it. Create a new link and send it again.
Still stuck?
Section titled “Still stuck?”Find the error message or the account status on Troubleshoot connection and OAuth errors. It covers each connected-account status, the errors on Scalekit’s connection page, OAuth app misconfiguration and provider-specific errors.
API reference
The endpoints this page's code calls, with every field and the SDK method for each: