Academy
3. Creating and Authorizing Connections via OAuth
Walk through the full connection lifecycle — selecting a server, authenticating via OAuth, granting scopes, and confirming the connection is active platform-wide.
MCP (Model Context Protocol) is a standard that lets OUPI's AI use external services as tools — reading emails, creating tasks, querying APIs, and more. The MCP Hub is your central control plane for these integrations. The lifecycle of a connection follows a clear path: browse the server catalog to find a service, create a connection by authenticating via OAuth with that service, grant the specific scopes it requests, and then the connection is live across every AI surface on the platform. Understanding this lifecycle is essential before you wire up production integrations.
Step 1 — Browse the Server Catalog. Navigate to the MCP Hub and open the server catalog. Each entry represents an external service that exposes tools through MCP. Open a server's detail page to inspect what it offers: the list of available tools, the actions they perform, and the scopes they'll require. This inspection step is critical — it tells you exactly what capabilities you're about to grant the AI before any authorization happens. Think of it as reviewing an API's documentation before integrating.
Step 2 — Create and Authorize the Connection. From the server detail, initiate a connection. OUPI redirects you to the external service's OAuth flow. You authenticate with your credentials on that service (not OUPI credentials) and then grant the requested scopes. Scopes define the boundary of what the AI can do — read-only access to a calendar vs. full read-write, for example. Once you approve, the OAuth token is stored and the connection appears under your Connections list. The AI can only reach what those scopes allow, and every call is logged, so the security model is explicit and auditable.
Step 3 — Confirm the Connection Is Active Platform-Wide. A single authorized connection is immediately available everywhere the AI acts: ChatPro (look for tool badges in the chat form), OUPI Studio, the Assistant, workflow steps, RAG imports, and Deep Research. Open the connection to inspect its tool list — this is the exact set of actions the AI sees and can invoke. There is no per-surface toggle; connect once, use everywhere. If a tool badge appears in ChatPro for that service, your connection is live.
After creating a connection, immediately open it and review the exposed tools. This is the AI's view of the service. If a tool you expected is missing, the service may require additional scopes — delete and recreate the connection with broader permissions.
Monitoring and Troubleshooting. The Execution Log records every tool call: which tool, timestamp, originating surface, and outcome (success or failure). Use it to debug integrations and audit AI behavior. The most common failure mode is an expired or revoked OAuth token on the service side. When a connection breaks, re-authorize or recreate it in the Hub. If you revoked access from the service's own connected-apps settings, you must also delete the stale connection in OUPI. Deleting a connection removes it platform-wide — all surfaces lose access instantly.
Open the MCP Hub, browse the server catalog, and create a connection to a service you use (e.g., a project tracker or email). Complete the OAuth flow, then open the new connection to inspect its tools. Finally, check ChatPro — you should see a tool badge confirming the connection is live.
The full connection lifecycle: (1) browse the server catalog to discover services and their tools, (2) create a connection via the service's OAuth flow, granting only the scopes you need, (3) confirm the connection is active — it works across ChatPro, Studio, workflows, RAG, and Deep Research with no extra setup. Monitor usage in the execution log, and remember that broken connections almost always mean an expired authorization. Delete + re-authorize to fix. Tool call costs are included in the AI operation's credits.