Skip to main content
When configuring OAuth connectors, you can use StackOne’s shared credentials or register your own OAuth apps with each provider. The right choice depends on how you’re using StackOne.

​
Connecting your own tools

If you’re using StackOne to connect your own company’s accounts (your Salesforce, your HubSpot, your Google Drive), StackOne’s shared credentials work well. When shared credentials work:
  • Low-volume internal tools and automations
  • Connecting your team’s SaaS accounts
  • Testing and development
  • Proof-of-concept integrations
When to consider your own OAuth app:
  • You want your company name on the OAuth consent screen
  • You need dedicated rate limits for high-volume usage
  • Your security team requires it as a matter of policy

​
Connecting your customers’ tools

If you’re using StackOne to let your customers connect their accounts (embedded iPaaS), use your own OAuth apps for production. Your customers will see your brand during OAuth consent instead of a third party, you’ll have dedicated rate limits, and if you ever want to list in a SaaS marketplace, you’ll need your own credentials anyway. Register your OAuth apps early - verification can take weeks for some providers. In the meantime, you can use StackOne’s credentials to keep testing. Contact support via in-app chat or Slack (or [email protected]) if you need additional auth configs pre-configured with StackOne’s OAuth apps.
If you plan to list your integration in any major SaaS marketplace, this isn’t optional.HubSpot requires your app to authorize requests with your own app ID. Apps using shared OAuth credentials are rejected during review.Zendesk explicitly prohibits using another developer’s OAuth client. Their terms require third-party developers to use their own global OAuth client.Microsoft requires multitenant apps to register in your own Entra ID tenant. Since 2020, apps without Publisher Verification show warnings that the app is “risky to download.”Atlassian, Salesforce, and Google Workspace all have similar requirements - partners must use their own OAuth applications registered under their own developer accounts.
Enterprise customers often require vendors to use their own OAuth credentials as part of security reviews. This shows up in security questionnaires and vendor assessments.Having your own OAuth app also gives you:
  • Direct access to each provider’s developer console
  • Visibility into your app’s usage and quotas
  • Control over scopes and permissions requested
  • Ability to respond to provider security notifications directly
API rate limits are enforced per OAuth app, not per end-user or per StackOne customer.Microsoft Graph allows 130,000 requests per 10 seconds per app across all tenants using that app. Google quotas are per Cloud Project. Slack is particularly strict: non-Marketplace apps are limited to 1 request per minute for some endpoints, versus 50+ for verified apps.With shared credentials, one customer’s bulk sync or misconfigured integration can exhaust limits for everyone. Your own OAuth app means your own quota - your customers aren’t competing with other StackOne users.

​
Setting up your own OAuth credentials

1

Register with the provider

Create an OAuth application in the provider’s developer console (Google Cloud Console, Microsoft Entra ID, etc.).
2

Add the redirect URI

https://api.stackone.com/connect/oauth2/{provider}/callback
Replace {provider} with the connector key (e.g., hubspot, googledrive).
3

Complete verification

Many providers require OAuth verification for production. Start early as this can take days or weeks.
4

Configure in StackOne

Go to Auth Configs, select your connector, and enter your Client ID and Client Secret.

​
Provider-specific guides

Google Drive

SharePoint

OneDrive

OAuth Proxy Redirect

​
Decision guide

Use caseStackOne credentialsYour own OAuth app
Testing / POC✅ RecommendedOptional
Connecting your own accounts✅ Works wellOptional
Low-volume internal tools✅ Works wellIf required by policy
High-volume usage⚠️ Shared rate limits✅ Dedicated limits
Production with end-customers⚠️ Not recommended✅ Recommended
Marketplace listing❌ Won’t pass review✅ Required