skills.rest
dlaporte
dlaporteCOMMUNITY
Explore all skills by this author →
GitHub

inno-add-connection

Provision per-user OAuth and token connections for mcp-container apps on the Innovation Platform.

Updated Jul 18, 2026
Search Tags:#oauth#mcp#api integration#token management#innovation platform#per-user credentials#connection provisioning
One-click install
npx skills add https://github.com/dlaporte/claude-plugins --skill inno-add-connection-dlaporte
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: inno-add-connection
Source: https://github.com/dlaporte/claude-plugins/tree/main/plugins/innovation-platform/skills/inno-add-connection
Command: npx skills add https://github.com/dlaporte/claude-plugins --skill inno-add-connection-dlaporte

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Apps often need to call an external backend as each individual user rather than with one shared service account, and wiring per-user credentials (OAuth sign-in, personal tokens, or client ID/secret pairs) into an app is error-prone. This Skill discovers how a backend authenticates users, provisions a Connection via the set_app_connection MCP tool, and wires the app code to consume per-user credentials safely. ## Core Features & Use Cases - Backend auth discovery: Probes .well-known discovery documents and WWW-Authenticate headers to determine whether a backend supports OAuth sign-in, personal access tokens, or per-user API clients. - Three connection strategies: Configures secret_form (pasted token), oauth2_client_creds (per-user client ID/secret pair), or oauth2_code (full authorization-code login) with correct endpoint, PKCE, refresh, and scope settings. - Safe provisioning and app wiring: Enforces an approval gate before the create-or-replace set_app_connection upsert, then shows how app code reads the X-Caller-Assertion header and calls connections.get to obtain the calling user's credential. - Use Case: A user wants their internal ticketing app to file tickets in a departmental SaaS as each employee. The Skill detects the backend issues personal tokens, provisions a secret_form Connection with a probe URL and help text, and adds the credential-fetching code to the app's MCP tools. ## Quick Start Connect my mcp-container app to our Acme CRM so each user acts as themselves, using the inno-add-connection skill.

Frequently Asked Questions about inno-add-connection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I connect my app to an external API as each individual user?▼

Provision a Connection with the set_app_connection MCP tool after discovering how the backend authenticates users. Choose secret_form for pasted personal tokens, oauth2_client_creds for per-user client ID/secret pairs, or oauth2_code for full sign-in, then wire the app to call connections.get with the caller assertion.

How do I find out which OAuth flow a backend supports?▼

Fetch the backend's .well-known/openid-configuration or .well-known/oauth-authorization-server document and read grant_types_supported. If no discovery document exists, make one unauthenticated curl request and inspect the WWW-Authenticate response header for Bearer or Basic hints.

When should I use a shared app secret instead of a per-user Connection?▼

Use a plain app variable when every user would share the exact same key or service account to reach the backend. Connections are only for backends that distinguish individual users; shared keys belong in the app's Variables via set_app_variable.

Can function or container apps consume Connections?▼

No, only mcp-container apps can consume Connections in v1. Function, mcp-function, and plain container apps cannot reach the platform's Connections seam, so the Skill stops rather than partially wiring them.

What happens if I re-run set_app_connection on an existing connection?▼

It is a create-or-replace upsert that overwrites label, strategy, config, and scopes. Changing the strategy or any credential endpoint deletes every user's stored credential and forces all connected users to reconnect, so confirm the configuration before the first call.

Why does my app report not_connected even after the user connected?▼

A not_connected response carrying locked: true means the credential exists but the MCP client authorized before the user's first connection, so the sealing key is unreachable. The fix is re-authorizing the MCP client (in Claude, /mcp and re-authenticate), not reconnecting the backend.

Related Skills

Explore More Software Engineering Skills→
ecoDriverltdecoDriverltd

mcp-csharp-publish

Publish C# MCP servers to NuGet, Docker, Azure, and the MCP Registry.

Official
Advanced
OpenAEC-FoundationOpenAEC-Foundation
163

frappe-ops-app-lifecycle

Automate Frappe app lifecycle from scaffolding to deployment and marketplace publishing.

Official
Advanced
sureshkushwaha123sureshkushwaha123

environment-secrets

Manage environment variables and secrets across development and production environments.

Community
Intermediate
nghiahsgsnghiahsgs
32

stripe-checkout

Integrate Stripe Checkout and webhook processing into Next.js App Router.

Community
Advanced