App Integrations

Connect external applications so your users can link files from those applications into the platform and run authenticated jobs against them — for example opening a Teamwork Cloud project, reading a Google Drive file, or querying a Windchill server.

Navigation: Admin hub > App Integrations (or go to /admin/integrations)

The page heading is Integrations.

How integrations work

• An integration is a connection to one external application (Teamwork Cloud, Google Workspace, Windchill, and others). You configure each integration once for your organization.
• Each integration has an auth standard that sets how people sign in to the application:
  • OAuth2 / OIDC — browser sign-in for applications that use single sign-on.
  • Basic — username & password for applications that authenticate with a stored username and password.
• Jobs sign in using a credential, which is one of two kinds:
  • A service account — a single sign-in shared across your organization and managed by administrators. Users can select it but cannot change it.
  • A linked account — a user's own connection to the application, which each user creates for themselves.
• When a function needs to sign in, the person launching the job selects which credential to use. Shared service accounts are labeled in the picker so users can tell them apart from their own linked accounts.

For the underlying concepts, see Integrations, jobs, and agents.

Note: Credentials are never attached to a queued job. When an agent claims an authenticated job, the platform issues a short-lived, single-use sign-in encrypted so that only that one agent can read it. The agent keeps it in a private file for the duration of the job and removes it when the job finishes — even if the job fails. No per-agent key setup is required.

Applications you can connect

Application	Auth standard	How users authenticate
Teamwork Cloud	Basic, or OAuth2 / OIDC	Each user links their own account (browser sign-in), or you provide a shared service account
Google Workspace	OAuth2 / OIDC	Each user links their own Google account (browser sign-in)
Windchill	Basic	A shared service account you create, or a personal linked account
3D Experience	Basic	A shared service account, or a personal linked account
Microsoft 365	OAuth2 / OIDC	Each user links their own account (browser sign-in)

The exact list of applications and the fields each one requires are presented in the Add integration dialog.

View integrations

The integrations table shows every configured application with:

• App (clickable — opens the integration's details)
• Description
• Created By
• Created At
• ⋯ actions menu (Delete — organization administrators only)

Add an integration

1. Click Add integration in the top-right.
2. In the Add integration dialog:
   • Enter a Name that identifies this integration (for example, Teamwork Cloud — Engineering). You can add more than one integration for the same application.
   • Select the Application.
   • Select the Auth standard offered by that application (OAuth2 / OIDC — browser sign-in or Basic — username & password).
   • Fill in the application-specific and sign-in fields that appear (see the walkthroughs below).
3. Click Add. The integration appears in the table.

The sections below walk through the most common setups end to end.

Connect Teamwork Cloud with OIDC

Use this when your Teamwork Cloud (TWC) is single-sign-on only, so users authenticate through your identity provider rather than a TWC username and password. This lets users run authenticated Cameo and Teamwork Cloud jobs with their own identity.

Setup has two halves, in order: a Teamwork Cloud administrator registers Istari Digital as an OpenID Connect client on the TWC Authentication Server, then an Istari Digital administrator creates the integration using the values from that registration.

Register Istari Digital on the Teamwork Cloud Authentication Server

A Teamwork Cloud administrator performs this once, on the TWC side. The only value needed from Istari Digital is the redirect (callback) URL: your Istari Digital web application's address followed by /connection-callback.html (for example, https://app.example.com/connection-callback.html).

TWC 2024x and later — in the TWC Settings application, go to OAuth clients > OpenID Connect > Create client and enter:

Setting	Value
Client name	IstariDigital (or similar)
Client secret	Generate a strong secret and record it — you enter it in Istari Digital below
Redirect URI(s)	The Istari Digital callback URL above
Grant types	Authorization Code and Refresh Token
Response type	code

The generated client key is the client ID you give to the Istari Digital administrator.

TWC 2022x and earlier (no OIDC client UI) — edit the Authentication Server configuration on the server host, then restart the Authentication Server:

In <install>/AuthServer/config/authserver.properties:

Property	Change
authentication.client.ids	Append your chosen client ID for Istari Digital (comma-separated list). The authorization endpoint rejects any client ID not in this list.
authentication.redirect.uri.whitelist	Append the Istari Digital callback URL above (comma-separated; full URL or prefix). Redirect URIs that are not whitelisted are rejected.
authentication.token.expirity	Access/id-token lifetime. A short lifetime is fine — Istari Digital renews tokens per job via the refresh token. ("Expirity" is the vendor's spelling — copy the property name exactly as shown.)

In webappplatform.properties:

Property	Change
authentication.client.secret	Set a strong client secret and record it — you enter it in Istari Digital below.

Note: Property names may vary slightly between TWC releases — verify against the Dassault Systèmes / No Magic documentation for your version.

Istari Digital identifies the TWC user from the token claims preferred_username, email, or sub (in that order). TWC populates these by default, so no change is normally needed — just confirm your Authentication Server has not been customized to strip them.

Create the integration in Istari Digital

Before you begin, gather from the registration above (or from your identity provider, if users sign in to TWC through a separate one):

• The issuer URL — the Authentication Server base URL (for example, https://twc.example.com:8443/authentication).
• The client ID registered for Istari Digital.
• The matching client secret.

Steps:

1. Go to Admin hub > App Integrations and click Add integration.
2. Enter a Name, set Application to Teamwork Cloud, and set Auth standard to OAuth2 / OIDC — browser sign-in.
3. Enter the Teamwork Cloud server address that your users' projects live on (for example, twc.example.com).
4. Fill in the OIDC fields:
   • Issuer — your identity provider's issuer URL.
   • Client ID and Client secret — the values you registered for Istari Digital.
   • Leave Authorization endpoint and Token endpoint blank to discover them automatically from the issuer, or enter them if your provider does not publish discovery.
   • Scopes and Use PKCE, along with Teamwork Cloud's sign-in details, are pre-filled with working defaults — change them only if your provider requires it.
5. Click Add.

Next: users connect their own Teamwork Cloud identity once under Linked Accounts > Link account, which opens a browser sign-in. After that, the linked account is available in the credential picker when they launch a job.

Network requirements

From	To	When / why
Users' browsers	The Istari Digital web application and the TWC Authentication Server (for example, https://twc.example.com:8443/authentication)	During account linking — the browser is redirected to the Authentication Server sign-in page and returns to Istari Digital's callback. If TWC delegates sign-in to a corporate identity provider, the browser must reach that too.
Istari Digital agents	The Istari Digital API and the TWC data server (the server address your users' projects live on)	While running Cameo / TWC jobs — the agent receives the encrypted sign-in from Istari Digital and connects to the TWC server.
Istari Digital platform	The TWC Authentication Server (outbound HTTPS)	OIDC discovery, the one-time sign-in exchange when a user links their account, and a token renewal each time a job runs.

Teamwork Cloud never initiates connections to Istari Digital — no inbound access to Istari Digital is required from the TWC side.

Connect Google Workspace

Use this so users can reference Google Drive and Google Workspace files in jobs (for example with the Google Workspace module). Each user links their own Google account, and jobs act with that user's Google access.

Register Istari Digital in the Google Cloud Console

A Google Cloud / Workspace administrator performs this once, in the Google Cloud Console. The only value needed from Istari Digital is the redirect (callback) URL: your Istari Digital web application's address followed by /connection-callback.html (for example, https://app.example.com/connection-callback.html).

1. Create (or select) a Google Cloud project to hold the client.
2. Configure the OAuth consent screen if the project does not have one yet. For a Google Workspace organization, choose user type Internal so only your organization's accounts can sign in (External works too, but Google may require app verification depending on scopes).
3. Under APIs & Services > Library, enable the Google Drive API — modules access Drive files through it.
4. Under APIs & Services > Credentials, click Create credentials > OAuth client ID, choose application type Web application, and add the Istari Digital callback URL to Authorized redirect URIs (no JavaScript origins are needed).
5. Record the generated client ID and client secret — you enter them in Istari Digital below.

You do not need to configure offline/refresh access — Istari Digital requests it automatically during the browser sign-in, so each linked account stays durable. The default Drive scope grants access only to files the user creates with or opens through Istari Digital, not their whole Drive.

Create the integration in Istari Digital

Before you begin, have the client ID and client secret from the registration above. The issuer is https://accounts.google.com.

Steps:

1. Go to Admin hub > App Integrations and click Add integration.
2. Enter a Name, set Application to Google Workspace, and set Auth standard to OAuth2 / OIDC — browser sign-in.
3. Fill in the OIDC fields:
   • Issuer — https://accounts.google.com.
   • Client ID and Client secret — from your Google Cloud OAuth client.
   • The Google Drive scope and offline-access settings are pre-filled, so Google returns a durable connection. Add scopes only if your module needs broader access.
4. Click Add.

Next: users connect their Google account once under Linked Accounts > Link account, then select it when launching a job.

Network requirements

From	To	When / why
Users' browsers	The Istari Digital web application and accounts.google.com	During account linking — the browser signs in to Google and returns to Istari Digital's callback.
Istari Digital agents	The Istari Digital API and Google APIs (www.googleapis.com)	While running jobs — the agent receives the encrypted sign-in from Istari Digital and calls the Google Drive API.
Istari Digital platform	Google's sign-in endpoints (accounts.google.com, oauth2.googleapis.com), outbound HTTPS	OIDC discovery, the one-time sign-in exchange when a user links their account, and a token renewal each time a job runs.

Google never initiates connections to Istari Digital — no inbound access to Istari Digital is required.

Connect Microsoft 365

Use this so users can run authenticated jobs against Microsoft 365 with their own identity. Each user links their own Microsoft account through a browser sign-in.

Register Istari Digital in Microsoft Entra

A Microsoft Entra (Azure AD) administrator performs this once, in the Microsoft Entra admin center. The only value needed from Istari Digital is the redirect (callback) URL: your Istari Digital web application's address followed by /connection-callback.html (for example, https://app.example.com/connection-callback.html).

1. Go to Identity > Applications > App registrations and click New registration.
2. Enter a Name (for example, Istari Digital), and under Supported account types choose Accounts in this organizational directory only (single tenant).
3. Under Redirect URI, select platform Web and enter the Istari Digital callback URL.
4. Click Register, then from the app's Overview page record the Application (client) ID and the Directory (tenant) ID.
5. Go to Certificates & secrets > New client secret, and record the secret value immediately (it is shown only once). Note its expiry date — you will need to create a new secret and update the integration in Istari Digital before it expires.

Istari Digital requests only the standard sign-in permissions (openid, email, profile, offline_access), which most tenants allow without admin consent. If your modules need Microsoft Graph data (for example, files or mail), add the corresponding delegated permissions under API permissions and grant admin consent if your tenant requires it.

Create the integration in Istari Digital

Before you begin, gather from the registration above:

• The issuer URL — https://login.microsoftonline.com/<tenant-id>/v2.0, using the Directory (tenant) ID from the app's Overview page.
• The Application (client) ID.
• The client secret value.

Steps:

1. Go to Admin hub > App Integrations and click Add integration.
2. Enter a Name, set Application to Microsoft 365, and set Auth standard to OAuth2 / OIDC — browser sign-in.
3. Fill in the OIDC fields:
   • Issuer — the tenant issuer URL above.
   • Client ID and Client secret — from your Entra app registration.
   • Scopes and Use PKCE are pre-filled with working defaults — add scopes only if your module needs Microsoft Graph access.
4. Click Add.

Next: users connect their Microsoft account once under Linked Accounts > Link account, then select it when launching a job.

Network requirements

From	To	When / why
Users' browsers	The Istari Digital web application and login.microsoftonline.com	During account linking — the browser signs in to Microsoft and returns to Istari Digital's callback.
Istari Digital agents	The Istari Digital API and Microsoft 365 endpoints (for example, graph.microsoft.com)	While running jobs — the agent receives the encrypted sign-in from Istari Digital and calls Microsoft services.
Istari Digital platform	Microsoft's sign-in endpoints (login.microsoftonline.com), outbound HTTPS	OIDC discovery, the one-time sign-in exchange when a user links their account, and a token renewal each time a job runs.

Microsoft never initiates connections to Istari Digital — no inbound access to Istari Digital is required.

Create a Windchill service account

Use this to set up a single shared Windchill service user that everyone in your organization runs jobs through, rather than each user linking a personal account.

Before you begin, gather the username and password of the Windchill service account you want jobs to use, and decide on a display name for it (users see this name in the credential picker).

Steps:

1. Make sure a Windchill integration exists. If not, click Add integration, enter a Name, set Application to Windchill (auth standard Basic — username & password), and click Add.
2. In the integrations table, open the Windchill integration and expand its service accounts section.
3. Click Add service account.
4. In the Add service account — Windchill dialog, enter the Name, Username, and Password of the service user.
5. Click Add.

The service account is shared across your organization. When users launch a Windchill job they can select it from the credential picker, where it is marked as a service account. Users cannot view or change its password.

Note: If you want each user to authenticate as themselves instead of through a shared account, skip the service account and have users add a personal linked account under Linked Accounts > Link account for the Windchill integration.

How users select a credential when running a job

When a function requires a sign-in, the job launcher shows a credential picker:

• Users see their own linked accounts plus any organization service accounts for that application. Service accounts are labeled so they are easy to distinguish.
• For functions that can optionally use a sign-in, users can attach a credential under the launcher's Advanced options.

Users manage their own linked accounts under Linked Accounts; service accounts are managed by administrators on this page and appear as read-only options in the picker.

Users submitting jobs through the Python SDK select a credential the same way, by passing auth_bindings to add_job — see Third-Party App Integrations (SDK).

View integration details

1. Click an App name in the table.
2. The detail section shows the integration's display name, its configured sign-in method, and any service accounts that have been added.

Delete an integration

1. Click the ⋯ menu on an integration row.
2. Select Delete.
3. Confirm the deletion.

Warning: Deleting an integration also removes the service accounts and linked accounts under it, and may break existing file connections and authenticated jobs that depend on it.