Gamut

Integrations

Connected Accounts

Connected accounts give agents OAuth access to SaaS APIs like Gmail, GitHub, and Slack. A secure proxy keeps tokens out of agent reach.

How the secure proxy works

Every API call an agent makes to a connected service passes through the Gamut host:

  1. Request: The agent sends an HTTP request to the proxy endpoint, authenticated with a synthetic token unique to that agent.
  2. Token validation: The proxy verifies the synthetic token and confirms the agent is mapped to the requested account.
  3. Host allowlisting: The proxy checks the target host against the provider's allowlist. A Gmail account can reach only gmail.googleapis.com and www.googleapis.com; requests to any other host are rejected.
  4. Scope enforcement: The proxy matches the method and path against the provider's scope map to find the OAuth scopes the call requires, then resolves the policy for those scopes (allow, review, or block). See Scope Policies.
  5. Token injection: If the request is allowed, the proxy fetches the real OAuth token from the account provider and injects it into the Authorization header.
  6. Forward and stream: The request goes to the upstream API, and the response streams back to the agent.
  7. Audit logging: Every request is logged with the agent, account, target host, path, method, status code, matched scopes, and policy decision.

The real OAuth token never enters the container. The synthetic token works only against the proxy and only for that agent, so a compromised or misbehaving agent has nothing worth leaking.

Account providers

Gamut brokers OAuth through an account provider: Composio or Nango. The provider hosts the consent flows and stores the upstream credentials; Gamut talks to both through the same abstraction, so accounts behave identically either way. Choose one in the Account Provider tab in Settings.

Composio proxy fallback

Some Composio configurations redact OAuth tokens (for example, Composio-managed auth configs). When Gamut detects a redacted token, it falls back to Composio's proxy execute API, which attaches the real credentials server-side. The fallback is transparent: the agent and the upstream API see the same behavior.

Adding an account

  1. Open Settings > Connections and click New connection, or use Add Connection on an agent's home page.
  2. Pick a provider from the directory.
  3. Sign in on the provider's consent screen and grant the requested permissions.
  4. Gamut records the account and fetches a display name.

The OAuth flow works in both the Electron desktop app (custom protocol callback) and the web interface (HTTP callback).

Display names

Gamut queries the provider for a user-specific name after connecting: the userinfo endpoint for Google accounts (your email address), the Microsoft Graph /me endpoint for Microsoft accounts. If the fetch fails, the provider's name ("Gmail") is used instead. Rename an account at any time by editing its display name.

Supported providers

The directory includes 45 OAuth providers:

  • Google Workspace: Gmail, Google Calendar, Google Drive, Google Sheets, Google Docs, Google Slides, Google Meet, Google Tasks, YouTube
  • Microsoft: Outlook, Microsoft Teams
  • Communication: Slack, Discord
  • Developer tools: GitHub, GitLab, Bitbucket, Sentry
  • Project management: Notion, Linear, Confluence, Asana, Monday.com, ClickUp, Trello
  • CRM and sales: HubSpot, Salesforce, Zendesk, Intercom
  • Cloud storage: Airtable, Dropbox, Box
  • Social media: LinkedIn, Instagram
  • Finance: Stripe, QuickBooks, Xero
  • Other: Mailchimp, Figma, Calendly, Typeform, Zoom

Account status

  • Active: The connection is valid and agents can use the account.
  • Revoked: Access was revoked on the provider's side (for example, the app was removed from Google account settings). Reconnect to restore it.
  • Expired: The OAuth token expired and could not be refreshed. Reconnect to restore it.

Deleting an account

Deleting a connected account removes the local record and the upstream connection at the account provider. All agent mappings to the account are removed automatically.

Related