Auth Integrations
Your external applications are most likely protected by an auth provider — an OAuth or OpenID Connect (OIDC) service, or a username-and-password (basic) login. To let the platform sign in to one of these applications on a user's behalf, an administrator registers how that application authenticates.
Credentials are encrypted at rest. They are never attached to a queued job: when an agent claims an authenticated job, the platform issues a short-lived encrypted payload so that only that one agent can read it, and the agent removes it after the job finishes.
How agents receive credentials
Agents that run authenticated jobs receive each sign-in encrypted specifically for them and decrypt it automatically — no manual key setup is required. An agent provisions and registers its own key the first time it starts.
Supported sign-in methods
Istari Digital supports the following applications and sign-in standards:
| Application | Sign-in standard |
|---|---|
| Google Workspace | OAuth2 / OIDC |
| Microsoft 365 | OAuth2 / OIDC |
| Teamwork Cloud | OAuth2 / OIDC, or Basic (username & password) |
| 3D Experience | Basic (username & password) |
| Windchill | Basic (username & password) |
If the application or sign-in method you need is not listed, please contact us.
Configuring a sign-in
Administrators configure how an application authenticates when they connect it. For step-by-step instructions — including Teamwork Cloud with OIDC, Google Workspace, and a Windchill service account — see App Integrations in the Administrator Guide.
Registration Information
To delegate authorization to an agent most auth providers require credentials or other private information referred to as Registration Information. The format for registration information depends on the auth protocol used. The following protocols are supported:
- OAuth 2.0
- Basic Login
- Token
Details on the schemas for registration information can be found below.
OAuth 2.0 Registration
Title: OAuth 2.0 Registration
| Type | object |
| Required | No |
| Additional properties | Not allowed |
Description: A registration secret for OAuth 2.0 authorization. The secret must be registered in order for functions to utilize OAuth2 authorization.
| Property | Pattern | Type | Deprecated | Definition | Title/Description |
|---|---|---|---|---|---|
| + authorizationIssuer | No | string | No | - | Authorization Issuer |
| + clientId | No | string | No | - | Client ID |
| + scope | No | string | No | - | Scope |
| - pkceEnabled | No | boolean | No | - | PKCE |
Example: OAuth 2.0
{
"clientId": "client-id-1234567890",
"authorizationIssuer": "https://accounts.google.com",
"scope": "https://www.googleapis.com/auth/documents.readonly",
"pkceEnabled": true
}
1. Property Basic Registration > authorizationIssuer
Title: Authorization Issuer
| Type | string |
| Required | Yes |
| Format | uri |
Description: The URL of the authorization server that generates and signs access tokens.
| Restrictions | |
|---|---|
| Min length | 1 |
2. Property Basic Registration > clientId
Title: Client ID
| Type | string |
| Required | Yes |
Description: Identifies the set of functions requesting access to resources protected by the auth server.
3. Property Basic Registration > scope
Title: Scope
| Type | string |
| Required | Yes |
Description: A space separated list of permissions requested by the set of functions.
Example:
"read write profile email offline_access"
4. Property Basic Registration > pkceEnabled
Title: PKCE
| Type | boolean |
| Required | No |
| Default | false |
Description: Whether or not the authorization server supports PKCE. Only PKCE with S256 code challenges is supported.
Examples:
true
false
Basic Registration
Title: Basic Registration
| Type | object |
| Required | No |
| Additional properties | Not allowed |
Description: A registration secret for Basic auth. This registration is only required if functions do not have the authenticating URL.
| Property | Pattern | Type | Deprecated | Definition | Title/Description |
|---|---|---|---|---|---|
| + authUrl | No | string | No | - | Auth URL |
Example: Basic Login
{
"authUrl": "https://acme.app/auth"
}
1. Property Basic Registration > authUrl
Title: Auth URL
| Type | string |
| Required | Yes |
| Format | uri |
Description: The URL used for authenticating the username and password.
| Restrictions | |
|---|---|
| Min length | 1 |
Token Registration
Title: Token Registration
| Type | object |
| Required | No |
| Additional properties | Not allowed |
Description: A registration secret for Token based auth. This registration is only required if functions do not have the authenticating URL.
| Property | Pattern | Type | Deprecated | Definition | Title/Description |
|---|---|---|---|---|---|
| + authUrl | No | string | No | - | Auth URL |
Example: Token
{
"authUrl": "https://acme.app/auth"
}
1. Property Token Registration > authUrl
Title: Auth URL
| Type | string |
| Required | Yes |
| Format | uri |
Description: The URL used for authenticating the token.
| Restrictions | |
|---|---|
| Min length | 1 |