access-apps.example.json

{
  "_readme": [
    "Every credential this weft offers as a SHARED connection, keyed by",
    "service name; each service holds a LIST of entries (always a list,",
    "even for one). Copy this file to `access-apps.json` (gitignored) and",
    "fill in the values, or point WEFT_ACCESS_APPS_FILE at your own copy.",
    "Every entry declares its `kind`:",
    "",
    "kind \"oauth_app\": an app users sign into through the service's",
    "consent screen. Carries a `label` (the name the connection list",
    "shows) and a `covers` set: exactly the permission ids (from the",
    "service's catalogue) this app asks for. Each app appears as its own",
    "one-click option in the editor with its `covers` shown; permissions",
    "are FIXED per app, the user picks an option rather than ticking.",
    "Several apps per service let a cheap permission tier avoid a",
    "provider's review process. Each app pins the provider addresses it",
    "signs in against (authUrl, tokenUrl), copied from the access",
    "node's service recipe; a connect through a registered app only ever",
    "talks to these. Register the callback URL the access node's connect",
    "panel shows (<this weft's public base>/access/oauth/callback) as the",
    "app's redirect URL, and re-register it whenever the public base",
    "changes. Some providers (Slack) only accept https callback URLs.",
    "An `events` block on an app makes weft RECEIVE that service's event",
    "pushes through this app: it carries only the per-deployment secret",
    "material (a signing secret, a public key, a push audience); which",
    "verification runs and every path comes from the service's own recipe.",
    "",
    "kind \"api_key\": the runtime's own key for a pasted-key service",
    "(openrouter, elevenlabs, ...): what the 'use the runtime's key' door",
    "hands out. At most one per service.",
    "",
    "A service listed nowhere offers no shared door: users bring their own",
    "credential (paste a key, register their own app).",
    "Every key weft defines here is camelCase (authUrl, signingSecret);",
    "client_id and client_secret keep OAuth's own spelling. Keys starting",
    "with _ are ignored."
  ],
  "slack": [
    {
      "_setup": "api.slack.com/apps -> Create New App (From scratch) -> OAuth & Permissions: add the callback URL as a Redirect URL and add your bot scopes. Client ID/Secret are under Basic Information.",
      "label": "Slack",
      "covers": [
        "chat:write",
        "channels:read",
        "channels:history",
        "groups:read",
        "groups:history",
        "im:write",
        "reactions:read",
        "reactions:write",
        "files:read",
        "files:write",
        "users:read",
        "users:read.email"
      ],
      "authUrl": "https://slack.com/oauth/v2/authorize",
      "tokenUrl": "https://slack.com/api/oauth.v2.access",
      "client_id": "REPLACE_WITH_SLACK_CLIENT_ID",
      "client_secret": "REPLACE_WITH_SLACK_CLIENT_SECRET",
      "events": {
        "signingSecret": "REPLACE_WITH_SLACK_SIGNING_SECRET"
      },
      "_setupEvents": "For event triggers via pushes: under Event Subscriptions, enable events, set the Request URL to <your public weft>/events/slack/messages, subscribe the bot to message.channels (plus reaction_added/reaction_removed and file_shared for those triggers), and copy the Signing Secret (Basic Information) here. For button approvals (Slack: Await Action), also enable Interactivity and set its Request URL to <your public weft>/events/slack/interactions.",
      "kind": "oauth_app"
    }
  ],
  "google": [
    {
      "_setup": "Uses ONE OAuth client in your Google Cloud project. Enable each API a listed app touches (Drive, Sheets, Docs, Calendar, Gmail), add the callback URL as an Authorized redirect URI, and add every scope any app's `covers` lists to the OAuth consent screen. Google grants are project-wide, so these apps share one client id; each only REQUESTS its own `covers`, so the consent screen shows just that app's scopes.",
      "label": "Google (all)",
      "covers": [
        "https://www.googleapis.com/auth/drive.file",
        "https://www.googleapis.com/auth/drive.readonly",
        "https://www.googleapis.com/auth/spreadsheets",
        "https://www.googleapis.com/auth/documents",
        "https://www.googleapis.com/auth/calendar.events",
        "https://www.googleapis.com/auth/gmail.send",
        "https://www.googleapis.com/auth/gmail.readonly",
        "https://www.googleapis.com/auth/gmail.modify"
      ],
      "authUrl": "https://accounts.google.com/o/oauth2/v2/auth",
      "tokenUrl": "https://oauth2.googleapis.com/token",
      "client_id": "REPLACE_WITH_GOOGLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_GOOGLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app",
      "_setupEvents": "Drive watch channels are pushed straight to weft, but Google only pushes to DOMAINS VERIFIED in this app's console: verify your weft's public domain there first."
    },
    {
      "_setup": "Uses ONE OAuth client in your Google Cloud project. Enable each API a listed app touches (Drive, Sheets, Docs, Calendar, Gmail), add the callback URL as an Authorized redirect URI, and add every scope any app's `covers` lists to the OAuth consent screen. Google grants are project-wide, so these apps share one client id; each only REQUESTS its own `covers`, so the consent screen shows just that app's scopes.",
      "label": "Google Drive",
      "covers": [
        "https://www.googleapis.com/auth/drive.file",
        "https://www.googleapis.com/auth/drive.readonly"
      ],
      "authUrl": "https://accounts.google.com/o/oauth2/v2/auth",
      "tokenUrl": "https://oauth2.googleapis.com/token",
      "client_id": "REPLACE_WITH_GOOGLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_GOOGLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    },
    {
      "_setup": "Uses ONE OAuth client in your Google Cloud project. Enable each API a listed app touches (Drive, Sheets, Docs, Calendar, Gmail), add the callback URL as an Authorized redirect URI, and add every scope any app's `covers` lists to the OAuth consent screen. Google grants are project-wide, so these apps share one client id; each only REQUESTS its own `covers`, so the consent screen shows just that app's scopes.",
      "label": "Google Sheets",
      "covers": [
        "https://www.googleapis.com/auth/drive.file",
        "https://www.googleapis.com/auth/drive.readonly",
        "https://www.googleapis.com/auth/spreadsheets"
      ],
      "authUrl": "https://accounts.google.com/o/oauth2/v2/auth",
      "tokenUrl": "https://oauth2.googleapis.com/token",
      "client_id": "REPLACE_WITH_GOOGLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_GOOGLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    },
    {
      "_setup": "Uses ONE OAuth client in your Google Cloud project. Enable each API a listed app touches (Drive, Sheets, Docs, Calendar, Gmail), add the callback URL as an Authorized redirect URI, and add every scope any app's `covers` lists to the OAuth consent screen. Google grants are project-wide, so these apps share one client id; each only REQUESTS its own `covers`, so the consent screen shows just that app's scopes.",
      "label": "Google Docs",
      "covers": [
        "https://www.googleapis.com/auth/drive.file",
        "https://www.googleapis.com/auth/documents"
      ],
      "authUrl": "https://accounts.google.com/o/oauth2/v2/auth",
      "tokenUrl": "https://oauth2.googleapis.com/token",
      "client_id": "REPLACE_WITH_GOOGLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_GOOGLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    },
    {
      "_setup": "Uses ONE OAuth client in your Google Cloud project. Enable each API a listed app touches (Drive, Sheets, Docs, Calendar, Gmail), add the callback URL as an Authorized redirect URI, and add every scope any app's `covers` lists to the OAuth consent screen. Google grants are project-wide, so these apps share one client id; each only REQUESTS its own `covers`, so the consent screen shows just that app's scopes.",
      "label": "Google Calendar",
      "covers": [
        "https://www.googleapis.com/auth/calendar.events"
      ],
      "authUrl": "https://accounts.google.com/o/oauth2/v2/auth",
      "tokenUrl": "https://oauth2.googleapis.com/token",
      "client_id": "REPLACE_WITH_GOOGLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_GOOGLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    },
    {
      "_setup": "Uses ONE OAuth client in your Google Cloud project. Enable each API a listed app touches (Drive, Sheets, Docs, Calendar, Gmail), add the callback URL as an Authorized redirect URI, and add every scope any app's `covers` lists to the OAuth consent screen. Google grants are project-wide, so these apps share one client id; each only REQUESTS its own `covers`, so the consent screen shows just that app's scopes.",
      "label": "Gmail",
      "covers": [
        "https://www.googleapis.com/auth/gmail.send",
        "https://www.googleapis.com/auth/gmail.readonly",
        "https://www.googleapis.com/auth/gmail.modify"
      ],
      "authUrl": "https://accounts.google.com/o/oauth2/v2/auth",
      "tokenUrl": "https://oauth2.googleapis.com/token",
      "client_id": "REPLACE_WITH_GOOGLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_GOOGLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    }
  ],
  "openrouter": [
    {
      "kind": "api_key",
      "label": "Runtime key",
      "key": "sk-or-..."
    }
  ],
  "elevenlabs": [
    {
      "kind": "api_key",
      "label": "Runtime key",
      "key": "sk_..."
    }
  ],
  "exa": [
    {
      "_setup": "dashboard.exa.ai -> API Keys. Serves the Web Search node's shared door.",
      "kind": "api_key",
      "label": "Runtime key",
      "key": "REPLACE_WITH_EXA_KEY"
    }
  ],
  "firecrawl": [
    {
      "_setup": "firecrawl.dev -> app -> API Keys. Serves the Fetch Page / Crawl Site shared door.",
      "kind": "api_key",
      "label": "Runtime key",
      "key": "fc-REPLACE"
    }
  ],
  "mistral": [
    {
      "_setup": "console.mistral.ai -> API Keys. Serves the Parse Document (OCR) shared door.",
      "kind": "api_key",
      "label": "Runtime key",
      "key": "REPLACE_WITH_MISTRAL_KEY"
    }
  ],
  "fal": [
    {
      "_setup": "fal.ai -> Dashboard -> Keys. Serves the media nodes' (image/video generation) shared door.",
      "kind": "api_key",
      "label": "Runtime key",
      "key": "REPLACE_WITH_FAL_KEY_ID:REPLACE_WITH_FAL_KEY_SECRET"
    }
  ],
  "notion": [
    {
      "_setup": "notion.so/my-integrations -> New integration -> pick Public. Add the callback URL as the Redirect URI, set 'User capabilities' to what the nodes need (read + insert + update content), and copy the OAuth client ID and secret here. Notion has no scope ids: the user picks which pages the connection can see on the consent screen, so `covers` stays empty.",
      "label": "Notion",
      "covers": [],
      "authUrl": "https://api.notion.com/v1/oauth/authorize",
      "tokenUrl": "https://api.notion.com/v1/oauth/token",
      "client_id": "REPLACE_WITH_NOTION_CLIENT_ID",
      "client_secret": "REPLACE_WITH_NOTION_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    }
  ],
  "airtable": [
    {
      "_setup": "airtable.com/create/oauth -> register an OAuth integration. Add the callback URL as the redirect URI, tick the data.records:read, data.records:write, and schema.bases:read scopes, and copy the client ID and secret here.",
      "label": "Airtable",
      "covers": [
        "data.records:read",
        "data.records:write",
        "schema.bases:read"
      ],
      "authUrl": "https://airtable.com/oauth2/v1/authorize",
      "tokenUrl": "https://airtable.com/oauth2/v1/token",
      "client_id": "REPLACE_WITH_AIRTABLE_CLIENT_ID",
      "client_secret": "REPLACE_WITH_AIRTABLE_CLIENT_SECRET",
      "events": {},
      "kind": "oauth_app"
    }
  ]
}