OAuth apps
Register your own Google and Microsoft OAuth apps for the connect flow.
Guides: Your own OAuth apps.
| Method | Path | Operation | Scope |
|---|---|---|---|
GET | /v1/oauth-apps | List tenant OAuth apps | admin |
POST | /v1/oauth-apps | Register a tenant OAuth app | admin |
PATCH | /v1/oauth-apps/{appId} | Change a tenant OAuth app: name, client secret, authority or Gmail push | admin |
DELETE | /v1/oauth-apps/{appId} | Delete a tenant OAuth app | admin |
Runs in your browser against api.workwae.com with the key you enter. Use a read-only key, limited to a test account if you can.
Required scope: admin.
OK
application/json- response
items*array<>curl -X GET 'https://api.workwae.com/v1/oauth-apps'{ "items": [ { "id": "c4e6a8b0-1d3f-4a5c-8e7b-9d1f3a5c7e9b", "provider": "google", "name": "string", "clientId": "string", "cloud": "global", "authority": "string", "gmailPush": { "topic": "string", "serviceAccount": "string" }, "gmailPushEndpoint": "https://app.example.com/", "createdAt": "2026-05-04T09:30:00.000Z" } ]}Runs against the live API with the key you enter: this change really happens. Use a key limited to a test account.
Required scope: admin.
application/json- body
provider*OAuthProvider"google""microsoft"cloud?MicrosoftCloud"global""gcc-high""dod""china"name*string1 <= length <= 100clientId*string1 <= lengthclientSecret*string1 <= lengthauthority?stringOK
application/json- response
id*stringuuidprovider*OAuthProvider"google""microsoft"name*stringclientId*stringcloud*|nullauthority*string|nullgmailPush*|nullgmailPushEndpoint*|nullcreatedAt*stringdate-timecurl -X POST 'https://api.workwae.com/v1/oauth-apps' \ -H 'Content-Type: application/json' \ -d '{ "provider": "google", "name": "string", "clientId": "string", "clientSecret": "string"}'{ "id": "c4e6a8b0-1d3f-4a5c-8e7b-9d1f3a5c7e9b", "provider": "google", "name": "string", "clientId": "string", "cloud": "global", "authority": "string", "gmailPush": { "topic": "string", "serviceAccount": "string" }, "gmailPushEndpoint": "https://app.example.com/", "createdAt": "2026-05-04T09:30:00.000Z"}Runs against the live API with the key you enter: this change really happens. Use a key limited to a test account.
Accounts on the app use the new secret from their next token refresh. gmailPush (Google apps) makes the app's accounts watch the topic with users.watch instead of being polled; null stops their watches and returns them to polling. Changing it wakes the app's accounts so it applies at once, and saving it again retries a watch Gmail refused.
Required scope: admin.
appId*stringuuidapplication/json- body
name?string1 <= length <= 100clientSecret?string1 <= lengthauthority?string1 <= lengthgmailPush?|nullOK
application/json- response
id*stringuuidprovider*OAuthProvider"google""microsoft"name*stringclientId*stringcloud*|nullauthority*string|nullgmailPush*|nullgmailPushEndpoint*|nullcreatedAt*stringdate-timecurl -X PATCH 'https://api.workwae.com/v1/oauth-apps/25e70e52-969f-478b-90b0-9ff86b0b87d4' \ -H 'Content-Type: application/json' \ -d '{}'{ "id": "c4e6a8b0-1d3f-4a5c-8e7b-9d1f3a5c7e9b", "provider": "google", "name": "string", "clientId": "string", "cloud": "global", "authority": "string", "gmailPush": { "topic": "string", "serviceAccount": "string" }, "gmailPushEndpoint": "https://app.example.com/", "createdAt": "2026-05-04T09:30:00.000Z"}Runs against the live API with the key you enter: this change really happens. Use a key limited to a test account.
Required scope: admin.
appId*stringuuidOK
application/json- response
curl -X DELETE 'https://api.workwae.com/v1/oauth-apps/25e70e52-969f-478b-90b0-9ff86b0b87d4'null