A connected account represents a user’s authorized connection to a third-party provider through Pipes. Connected accounts store the OAuth credentials and scopes granted during the authorization flow.
When listing providers for a user, each provider includes a nested connected_account showing the user’s connection status.
Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.
cURL
| curl --request POST \ | |
| --url "https://api.workos.com/data-integrations/github/authorize" \ | |
| --header "Authorization: Bearer sk_example_123456789" \ | |
| --header "Content-Type: application/json" \ | |
| -d @- <<'BODY' | |
| { | |
| "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT" | |
| } | |
| BODY |
| import { WorkOS } from '@workos-inc/node'; | |
| const workos = new WorkOS('sk_example_123456789'); | |
| const { url } = await workos.pipes.authorizeDataIntegration({ | |
| slug: 'github', | |
| userId: 'user_01EHZNVPK3SFK441A1RGBFSHRT', | |
| }); |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.pipes.authorize_data_integration( | |
| slug: "github", | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.pipes.authorize_data_integration( | |
| slug="github", user_id="user_01EHZNVPK3SFK441A1RGBFSHRT" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.Pipes().AuthorizeDataIntegration(context.Background(), "github", &workos.PipesAuthorizeDataIntegrationParams{ | |
| UserID: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| }) | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->pipes() | |
| ->authorizeDataIntegration( | |
| slug: "github", | |
| userId: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| ); |
| import com.workos.WorkOS; | |
| import com.workos.pipes.PipesApi.AuthorizeDataIntegrationOptions; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| AuthorizeDataIntegrationOptions options = AuthorizeDataIntegrationOptions.builder() | |
| .userId("user_01EHZNVPK3SFK441A1RGBFSHRT") | |
| .build(); | |
| workos.pipes.authorizeDataIntegration("github", options); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.Pipes.AuthorizeDataIntegrationAsync("github", new PipesAuthorizeDataIntegrationOptions { | |
| UserId = "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| }); |
| use workos::Client; | |
| use workos::pipes::AuthorizeDataIntegrationParams; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .pipes() | |
| .authorize_data_integration( | |
| "github", | |
| AuthorizeDataIntegrationParams { | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT".into(), | |
| ..Default::default() | |
| } | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
| { | |
| "url": "https://api.workos.com/data-integrations/q2czJKmVAraSBg8xFpT7M9uR/authorize-redirect" | |
| } |
POST/data-integrations
Parameters
Returns
Imports a connected account for a user by directly providing OAuth tokens. This is useful for migrating existing connections from another system.
The state field is derived from the token combination when not explicitly set. If no tokens are provided, the state defaults to needs_reauthorization.
cURL
| curl --request POST \ | |
| --url "https://api.workos.com/user_management/users/user_01EHZNVPK3SFK441A1RGBFSHRT/connected_accounts/github" \ | |
| --header "Authorization: Bearer sk_example_123456789" \ |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.pipes.create_user_connected_account( | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.pipes.create_user_connected_account( | |
| user_id="user_01EHZNVPK3SFK441A1RGBFSHRT", slug="github" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.Pipes().CreateUserConnectedAccount(context.Background(), "user_01EHZNVPK3SFK441A1RGBFSHRT", "github") | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->pipes() | |
| ->createUserConnectedAccount( | |
| userId: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github", | |
| ); |
| import com.workos.WorkOS; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| workos.pipes.createUserConnectedAccount("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.Pipes.CreateUserConnectedAccountAsync("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| use workos::Client; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .pipes() | |
| .create_user_connected_account( | |
| "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "github" | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
| { | |
| "object": "connected_account", | |
| "id": "data_installation_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "organization_id": null, | |
| "scopes": [ | |
| "repo", | |
| "user:email" | |
| ], | |
| "auth_method": "oauth", | |
| "api_key_last_4": null, | |
| "state": "connected", | |
| "created_at": "2024-01-16T14:20:00.000Z", | |
| "updated_at": "2024-01-16T14:20:00.000Z" | |
| } |
Feature flagged
POST/user_management
Parameters
Returns
Token combinations are validated on create. Invalid combinations – such as providing only expires_at without an access_token – will return a 422 error. See the token validation rules below.
When creating a connected account, the following token combination rules apply:
- No tokens provided →
stateis set toneeds_reauthorization. access_tokenwithexpires_atandrefresh_token→ valid,stateisconnected.access_tokenonly (noexpires_at) → valid,stateisconnected.access_tokenwithexpires_atbut norefresh_token→ rejected (422).refresh_tokenonly (noaccess_token) → valid,expires_atis set to now.expires_atonly (noaccess_token) → rejected (422).
- 409 Conflict: A connected account already exists for this user, integration, and organization.
- 422: Invalid token combination or the data integration is not in a valid state.
Retrieves a user’s connected account for a specific provider.
cURL
| curl "https://api.workos.com/user_management/users/user_01EHZNVPK3SFK441A1RGBFSHRT/connected_accounts/github" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| import { WorkOS } from '@workos-inc/node'; | |
| const workos = new WorkOS('sk_example_123456789'); | |
| const connectedAccount = await workos.pipes.getUserConnectedAccount({ | |
| userId: 'user_01EHZNVPK3SFK441A1RGBFSHRT', | |
| slug: 'github', | |
| }); |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.pipes.get_user_connected_account( | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.pipes.get_user_connected_account( | |
| user_id="user_01EHZNVPK3SFK441A1RGBFSHRT", slug="github" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.Pipes().GetUserConnectedAccount(context.Background(), "user_01EHZNVPK3SFK441A1RGBFSHRT", "github") | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->pipes() | |
| ->getUserConnectedAccount( | |
| userId: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github", | |
| ); |
| import com.workos.WorkOS; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| workos.pipes.getUserConnectedAccount("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.Pipes.GetUserConnectedAccountAsync("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| use workos::Client; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .pipes() | |
| .get_user_connected_account( | |
| "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "github" | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
| { | |
| "object": "connected_account", | |
| "id": "data_installation_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "organization_id": null, | |
| "scopes": [ | |
| "repo", | |
| "user:email" | |
| ], | |
| "auth_method": "oauth", | |
| "api_key_last_4": null, | |
| "state": "connected", | |
| "created_at": "2024-01-16T14:20:00.000Z", | |
| "updated_at": "2024-01-16T14:20:00.000Z" | |
| } |
GET/user_management
Parameters
Returns
Updates a user’s connected account tokens, scopes, or state for a specific provider.
cURL
| curl --request PUT \ | |
| --url "https://api.workos.com/user_management/users/user_01EHZNVPK3SFK441A1RGBFSHRT/connected_accounts/github" \ | |
| --header "Authorization: Bearer sk_example_123456789" \ | |
| --header "Content-Type: application/json" \ | |
| -d @- <<'BODY' | |
| { | |
| "access_token": "gho_16C7e42F292c6912E7710c838347Ae178B4a", | |
| "refresh_token": "ghr_xxxxxxxxxxxxxxxxxxxx", | |
| "expires_at": "2025-12-31T23:59:59.000Z", | |
| "scopes": [ | |
| "repo", | |
| "user:email" | |
| ], | |
| "state": "connected" | |
| } | |
| BODY |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.pipes.update_user_connected_account( | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.pipes.update_user_connected_account( | |
| user_id="user_01EHZNVPK3SFK441A1RGBFSHRT", slug="github" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.Pipes().UpdateUserConnectedAccount(context.Background(), "user_01EHZNVPK3SFK441A1RGBFSHRT", "github") | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->pipes() | |
| ->updateUserConnectedAccount( | |
| userId: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github", | |
| ); |
| import com.workos.WorkOS; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| workos.pipes.updateUserConnectedAccount("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.Pipes.UpdateUserConnectedAccountAsync("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| use workos::Client; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .pipes() | |
| .update_user_connected_account( | |
| "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "github" | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
| { | |
| "object": "connected_account", | |
| "id": "data_installation_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "organization_id": null, | |
| "scopes": [ | |
| "repo", | |
| "user:email" | |
| ], | |
| "auth_method": "oauth", | |
| "api_key_last_4": null, | |
| "state": "connected", | |
| "created_at": "2024-01-16T14:20:00.000Z", | |
| "updated_at": "2024-01-16T14:20:00.000Z" | |
| } |
Feature flagged
PUT/user_management
Parameters
Returns
Unlike the create endpoint, update does not validate token combinations. The provided values are applied directly, so callers are responsible for maintaining valid token and state combinations. For example, setting state to connected without providing valid tokens will leave the connected account in an inconsistent state.
- 404 Not Found: No connected account exists for the given user and slug.
Disconnects WorkOS’s account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect.
This does not revoke access on the provider side. The user may need to disconnect the application directly from the provider’s settings.
Returns a 204 No Content response on success.
cURL
| curl --request DELETE \ | |
| --url "https://api.workos.com/user_management/users/user_01EHZNVPK3SFK441A1RGBFSHRT/connected_accounts/github" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| import { WorkOS } from '@workos-inc/node'; | |
| const workos = new WorkOS('sk_example_123456789'); | |
| await workos.pipes.deleteUserConnectedAccount({ | |
| userId: 'user_01EHZNVPK3SFK441A1RGBFSHRT', | |
| slug: 'github', | |
| }); |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.pipes.delete_user_connected_account( | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.pipes.delete_user_connected_account( | |
| user_id="user_01EHZNVPK3SFK441A1RGBFSHRT", slug="github" | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.Pipes().DeleteUserConnectedAccount(context.Background(), "user_01EHZNVPK3SFK441A1RGBFSHRT", "github") | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->pipes() | |
| ->deleteUserConnectedAccount( | |
| userId: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| slug: "github", | |
| ); |
| import com.workos.WorkOS; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| workos.pipes.deleteUserConnectedAccount("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.Pipes.DeleteUserConnectedAccountAsync("user_01EHZNVPK3SFK441A1RGBFSHRT", "github"); |
| use workos::Client; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .pipes() | |
| .delete_user_connected_account( | |
| "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "github" | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
DELETE/user_management
Parameters
Returns
Creates or updates an API-key-based installation for the specified integration and user. If an installation already exists, the stored API key is rotated to the new value.
cURL
| curl --request PUT \ | |
| --url "https://api.workos.com/data-integrations/github/api-key" \ | |
| --header "Authorization: Bearer sk_example_123456789" \ | |
| --header "Content-Type: application/json" \ | |
| -d @- <<'BODY' | |
| { | |
| "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "secret": "sk-1234567890abcdef" | |
| } | |
| BODY |
| import { WorkOS } from '@workos-inc/node'; | |
| const workos = new WorkOS('sk_example_123456789'); | |
| await workos.pipes.updateDataIntegrationApiKey({ | |
| slug: 'github', | |
| userId: 'user_01EHZNVPK3SFK441A1RGBFSHRT', | |
| secret: 'sk-1234567890abcdef', | |
| }); |
| require "workos" | |
| WorkOS.configure do |config| | |
| config.api_key = "sk_example_123456789" | |
| end | |
| WorkOS.client.pipes.update_data_integration_api_key( | |
| slug: "github", | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| secret: "sk-1234567890abcdef" | |
| ) |
| from workos import WorkOSClient | |
| client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789") | |
| client.pipes.update_data_integration_api_key( | |
| slug="github", | |
| user_id="user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| secret="sk-1234567890abcdef", | |
| ) |
| package main | |
| import ( | |
| "context" | |
| "github.com/workos/workos-go/v9" | |
| ) | |
| func main() { | |
| client := workos.NewClient("sk_example_123456789") | |
| _, err := client.Pipes().UpdateDataIntegrationAPIKey(context.Background(), "github", &workos.PipesUpdateDataIntegrationAPIKeyParams{ | |
| UserID: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| Secret: "sk-1234567890abcdef", | |
| }) | |
| if err != nil { | |
| panic(err) | |
| } | |
| } |
| <?php | |
| use WorkOS\WorkOS; | |
| $workos = new WorkOS( | |
| apiKey: "sk_example_123456789", | |
| clientId: "client_123456789", | |
| ); | |
| $workos | |
| ->pipes() | |
| ->updateDataIntegrationApiKey( | |
| slug: "github", | |
| userId: "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| secret: "sk-1234567890abcdef", | |
| ); |
| import com.workos.WorkOS; | |
| import com.workos.pipes.PipesApi.UpdateDataIntegrationApiKeyOptions; | |
| WorkOS workos = new WorkOS("sk_example_123456789"); | |
| UpdateDataIntegrationApiKeyOptions options = | |
| UpdateDataIntegrationApiKeyOptions.builder() | |
| .userId("user_01EHZNVPK3SFK441A1RGBFSHRT") | |
| .secret("sk-1234567890abcdef") | |
| .build(); | |
| workos.pipes.updateDataIntegrationApiKey("github", options); |
| using WorkOS; | |
| var client = new WorkOSClient(new WorkOSOptions { | |
| ApiKey = "sk_example_123456789", | |
| ClientId = "client_123456789", | |
| }); | |
| await client.Pipes.UpdateDataIntegrationApiKeyAsync("github", new PipesUpdateDataIntegrationApiKeyOptions { | |
| UserId = "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| Secret = "sk-1234567890abcdef", | |
| }); |
| use workos::Client; | |
| use workos::pipes::UpdateDataIntegrationApiKeyParams; | |
| #[tokio::main] | |
| async fn main() -> Result<(), workos::Error> { | |
| let client = Client::builder() | |
| .api_key("sk_example_123456789") | |
| .client_id("client_123456789") | |
| .build(); | |
| let _result = client | |
| .pipes() | |
| .update_data_integration_api_key( | |
| "github", | |
| UpdateDataIntegrationApiKeyParams { | |
| user_id: "user_01EHZNVPK3SFK441A1RGBFSHRT".into(), | |
| secret: "sk-1234567890abcdef".into(), | |
| ..Default::default() | |
| } | |
| ) | |
| .await?; | |
| Ok(()) | |
| } |
| { | |
| "object": "connected_account", | |
| "id": "data_installation_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "user_id": "user_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "scopes": [], | |
| "auth_method": "api_key", | |
| "api_key_last_4": "cdef", | |
| "state": "connected", | |
| "created_at": "2024-01-16T14:20:00.000Z", | |
| "updated_at": "2024-01-16T14:20:00.000Z" | |
| } |
Feature flagged
PUT/data-integrations
Parameters
Returns
Credentials Continue to the next section
Up next