Quickstart

This guide walks you through connecting a user’s Google account via OAuth and retrieving a valid access token.

1. Install an SDK

Node

npm install @authpipe/node

Go

go get github.com/authpipe-dev/authpipe-go

Python

pip install authpipe

2. Create a workspace

Sign up at authpipe.dev and create a workspace. You’ll get a secret API key (starts with sk_) and a publishable key (starts with pk_).

• Secret key — Full API access. Use server-side only.
• Publishable key — Can only create auth sessions. Safe for client-side use.

3. Configure a provider

Register your Google OAuth app credentials with Authpipe.

Node

import { Authpipe } from "@authpipe/node";

const authpipe = new Authpipe({
  apiKey: process.env.AUTHPIPE_API_KEY, // sk_...
});

const config = await authpipe.createProviderConfig({
  provider_id: "google",
  client_id: "your-google-client-id",
  client_secret: "your-google-client-secret",
  oauth_redirect_url: "https://api.authpipe.dev/oauth/callback",
  attachment: "user",
  enabled: true,
  scopes: ["https://www.googleapis.com/auth/drive.readonly"],
});

Go

client := authpipe.NewClient(os.Getenv("AUTHPIPE_API_KEY"))

config, err := client.CreateProviderConfig(ctx, &authpipe.CreateProviderConfigParams{
  ProviderID:       "google",
  ClientID:         "your-google-client-id",
  ClientSecret:     "your-google-client-secret",
  OAuthRedirectURL: "https://api.authpipe.dev/oauth/callback",
  Attachment:       "user",
  Enabled:          true,
  Scopes:           []string{"https://www.googleapis.com/auth/drive.readonly"},
})

Python

from authpipe import Authpipe

client = Authpipe(api_key=os.environ["AUTHPIPE_API_KEY"])

config = client.create_provider_config(
    provider_id="google",
    client_id="your-google-client-id",
    client_secret="your-google-client-secret",
    oauth_redirect_url="https://api.authpipe.dev/oauth/callback",
    attachment="user",
    enabled=True,
    scopes=["https://www.googleapis.com/auth/drive.readonly"],
)

The oauth_redirect_url must match what you registered in the Google Cloud Console. This is Authpipe’s callback endpoint, not your app’s.

4. Create an auth session

When a user clicks “Connect Google,” create an auth session and redirect them.

Node

const session = await authpipe.createAuthSession({
  provider: "google",
  tenantId: "org_acme",
  userId: "user_123",
  redirectUrl: "https://yourapp.com/connections/success",
});

// Redirect the user to session.authorization_url
res.redirect(session.authorization_url);

Go

session, err := client.CreateAuthSession(ctx, &authpipe.CreateAuthSessionParams{
  Provider:    "google",
  TenantID:    "org_acme",
  UserID:      "user_123",
  RedirectURL: "https://yourapp.com/connections/success",
})

// Redirect the user to session.AuthorizationURL
http.Redirect(w, r, session.AuthorizationURL, http.StatusFound)

Python

session = client.create_auth_session(
    provider="google",
    tenant_id="org_acme",
    user_id="user_123",
    redirect_url="https://yourapp.com/connections/success",
)

# Redirect the user to session.authorization_url

Authpipe handles the OAuth callback, exchanges the code for tokens, encrypts and stores them, then redirects the user to your redirect_url.

5. Get a credential

Retrieve a valid access token whenever you need to call the Google API.

Node

const { credential, credential_type, source } = await authpipe.getCredential({
  provider: "google",
  tenantId: "org_acme",
  userId: "user_123",
});

// Use the credential to call Google's API
const resp = await fetch("https://www.googleapis.com/drive/v3/files", {
  headers: { Authorization: `Bearer ${credential}` },
});

Go

result, err := client.GetCredential(ctx, &authpipe.GetCredentialParams{
  Provider: "google",
  TenantID: "org_acme",
  UserID:   "user_123",
})

// Use result.Credential to call Google's API
req, _ := http.NewRequest("GET", "https://www.googleapis.com/drive/v3/files", nil)
req.Header.Set("Authorization", "Bearer "+result.Credential)

Python

result = client.get_credential(
    provider="google",
    tenant_id="org_acme",
    user_id="user_123",
)

# Use result.credential to call Google's API
resp = httpx.get(
    "https://www.googleapis.com/drive/v3/files",
    headers={"Authorization": f"Bearer {result.credential}"},
)

If the token has expired, Authpipe refreshes it automatically before returning it.

Next steps

• Core Concepts — Understand the full domain model.
• OAuth Connections — Deep dive into the OAuth flow.
• API Key Storage — Store non-OAuth credentials.
• Tenant/User Model — Understand tenant-attached vs. user-attached connections.