OAuth2

Overview

With OAuth2 you sign in once at the provider in the browser; RUNOS receives an access token and a refresh token and renews access itself afterwards. RUNOS stores no password for this. Microsoft 365, Outlook.com and Google (Gmail) work this way. How to create a connector is described under None.

OAuth flow	When
Authorization Code	A user signs in in the browser, e.g. with their mailbox. For MS365 and Gmail.
Client Credentials	A service account without a user, e.g. an app registration in Microsoft Entra (template Azure Service Principal). There is no browser sign-in; RUNOS gets the token with the client ID and client secret.

Sign in: with Authorization Code click Sign in with browser. RUNOS opens the provider’s sign-in page and waits at the Redirect URI (default http://localhost:5000/) for the response. Afterwards the access and refresh tokens are stored.

Renew: RUNOS renews the token automatically when a workflow uses the connector and the token expires in less than a minute. Refresh token requests a new one right away. If the token can no longer be renewed (password changed, access revoked), the status shows Token expired; sign in again then.

Structure

Field	Meaning
Client ID, Client secret	ID and secret of the application at the provider (preset for the Microsoft templates)
Scopes	permissions separated by spaces, e.g. offline_access Mail.Send
Auth endpoint, Token endpoint	the provider’s addresses for sign-in and token
Redirect URI	address where RUNOS receives the sign-in; must be registered at the provider
OAuth flow	Authorization Code or Client Credentials
Access token, Refresh token, Expires	after sign-in: the tokens (encrypted) and their expiry

In the workflow you give the HTTPRequest action the connector’s name: "Connector": "<Name>". It then sends the access token, renews it before it expires and repeats a request once with a new token if the server rejects it (401). The token itself is in {{connector.<Name>.AccessToken}}, e.g. for "AuthType": "Bearer", "AuthToken": "{{connector.<Name>.AccessToken}}".

The Outlook365 action only gets the connector’s name ("Connector": "OutlookMail") and handles the sign-in itself.

Example

Microsoft 365, a user signs in. Template Microsoft Outlook Mail, name OutlookMail, Sign in with browser. Then read your own calendar entries (add Calendars.Read to the Scopes and sign in again):

{
  "Type": "HttpRequest",
  "Name": "Events",
  "Parameters": {
    "Url": "https://graph.microsoft.com/v1.0/me/events?$select=subject,start,end&$top=20",
    "Connector": "OutlookMail",
    "AutoPagination": true
  }
}

Service account with client credentials. Template Azure Service Principal: register an app in Microsoft Entra, grant application permissions (e.g. User.Read.All) with admin consent; enter the client ID, client secret and, in the Token endpoint, the tenant ID. Scope https://graph.microsoft.com/.default.

{
  "Type": "HttpRequest",
  "Name": "Users",
  "Parameters": {
    "Url": "https://graph.microsoft.com/v1.0/users?$select=displayName,mail",
    "Connector": "Entra",
    "AutoPagination": true
  }
}

With client credentials there is no me; address users and mailboxes by their address, e.g. /users/info@example.com/messages.