Skip to main content
An OAuth client registered on your Glean instance is required. Static registration needs Glean admin access. Dynamic registration does not, but yields a restricted scope set.

​
Prerequisites

Confirm what you need before starting setup.

  • Your Glean instance subdomain, taken from your backend host
  • A Glean admin has enabled the Glean OAuth Server in the Admin Console under Settings then Third-party access (OAuth)
  • Glean admin access if you want to register a static OAuth client

​
Register an OAuth client

The connector needs a Client ID and Client Secret for your Glean instance. There are two ways to obtain them.

1

Create a static client (recommended)

Enables actions: Add Collection Items, Add Verification Reminder, Authorize Action Pack, Authorize Tool Server, Autocomplete, Call Tool, Chat, Check Datasource Authorization, Create Announcement, Create Answer, Create Authentication Token, Create Collection, Create Data Loss Prevention Policy, Create Findings Export, Create One Time Report, Create Pin, Create Shortcut, Delete All Chats, Delete Announcement, Delete Answer, Delete Chat Files, Delete Chats, Delete Collection, Delete Collection Item, Delete Findings Export, Delete Pin, Delete Shortcut, Delete Skill, Get Action Pack Auth Status, Get Agent, Get Agent Schemas, Get Answer, Get Chat, Get Chat Application, Get Chat Files, Get Collection, Get Data Loss Prevention Policy, Get Datasource Credential Status, Get Datasource Instance Configuration, Get Document Permissions, Get Document Visibility Overrides, Get Documents, Get Feed, Get Insights, Get People, Get Pin, Get Recommendations, Get Report Status, Get Shortcut, Get Skill, Get Skill Version, Get Tool Server Auth Status, Get Tool Server Tools, Import Skills, List Agents, List Chats, List Collections, List Data Loss Prevention Policies, List Documents By Facets, List Entities, List Findings Exports, List Pins, List Shortcuts, List Skill Versions, List Skills, List Tools, List Verifications, Preview Skill Source, Report Activity, Report Feedback, Rotate Datasource Credentials, Run Agent, Search, Set Document Visibility Overrides, Summarize, Sync Skill, Update Announcement, Update Answer, Update Collection, Update Collection Item, Update Data Loss Prevention Policy, Update Datasource Instance Configuration, Update Pin, Update Shortcut, Update Skill, Verify Document

Register the client in the Glean Admin Console. This path needs admin access and can be allow-listed for the full scope set.

  • Sign in to the Glean Admin Console
  • Go to Users & permissions then Third-party access (OAuth)
  • Under Static clients, click Create client
  • Enter a client name and the redirect URI below
  • Select the scopes the client is allowed to request
  • Copy the Client ID and Client Secret. The secret is shown once and cannot be retrieved again
2

Or register a dynamic client

Dynamic client registration follows RFC 7591 and needs no admin access.

  • POST a registration request to https://{instance}-be.glean.com/oauth/register, including the redirect URI below
  • Glean applies a restricted scope set to dynamically registered clients, and the exact set is configured per tenant, so a dynamic client may not be able to obtain every scope listed above
  • If that set excludes offline_access, no refresh token is issued and the connection must be re-authorized once the access token expires. Ask your Glean representative to widen the set
  • An admin can disable dynamic registration on the instance
3

Configure the redirect URI and grant

Glean runs an OAuth 2.1 implementation, so these values are fixed.

  • Redirect URI, exact and case sensitive: https://api.stackone.com/connect/oauth2/glean/callback
  • Grant type: authorization code with PKCE using S256. Implicit and password grants are not supported
  • Token endpoint auth method: client_secret_post, so the client secret travels in the token request body
4

Set the connector scopes

Back in StackOne, paste the space-separated scope list your OAuth client is allowed to request into the Scopes field.

  • Leaving Scopes empty requests every scope the connector supports, which suits a static client allow-listed for the full set
  • Dynamically registered clients hold a restricted scope set, so enter that set explicitly rather than leaving the field empty
  • Requesting a scope the client cannot hold can fail authorization, and any action whose scope was not requested fails with a 403

​
Find your instance subdomain

The instance is the part of your Glean backend host before -be.glean.com. For a backend host of acme-prod-be.glean.com the instance is acme-prod. The connector uses it to build the API base URL and both OAuth endpoints, all of which are per-instance.

​
Creating the StackOne Connector Profile

To create the Connector Profile in StackOne for Glean:
1

Navigate to Connector Profiles

Login to StackOne and navigate to Connector Profiles
2

Create New Connector Profile

  • Click + Connector Profile
  • Search for and select Glean
  • Select Type as OAuth 2.0
  • Fill out the fields using details retrieved from your provider:
    • Client ID
    • Client Secret
    • Scopes (Optional)
  • (Optional) Select Actions to be enabled for this Connector Profile
  • Click Create profile
Congratulations! The new Connector Profile will now show up in your project ready to be used. You can now continue to Link Accounts for Glean.