miton
Request beta access

OAuth integrations

Connect third-party services with provider consent, least-privilege scopes and local credential storage.

Product stage
Development build
Last reviewed
2026-09-17
Successful result
The change is visible in the active project.

What this accomplishes

Understand what happens when you connect a third-party service to Miton, where the resulting credential is stored, and which parts of the connection are handled by Miton or by the provider.

Current availability

This page documents behaviour verified in Miton development builds. Miton is still pre-release and is not publicly downloadable; invited beta users will receive a signed desktop build with automatic updates.

Before you start

  • A Miton development build with the provider connection available.
  • An account or workspace with the third-party provider you want to connect.
  • Access to the system browser so you can review the provider’s consent screen.

This is not Miton account sign-in

These connections authorise Miton to work with a service you already use. They do not create a Miton account, sync your credentials across devices, or give Miton access to unrelated provider data. You review and approve the provider’s requested scopes on the provider’s own consent screen.

Two connection paths

Miton keeps the provider contract visible because OAuth is not identical across services.

Connection path Providers What happens
Direct native flow GitLab, Linear, Slack, Google and Cloudflare Miton opens the system browser, uses Authorization Code + PKCE, receives the callback on the local device and saves the resulting credential in the OS-backed credential store.
Brokered flow GitHub, Bitbucket, Notion and Figma Miton opens the provider consent screen and uses the dedicated OAuth broker for the confidential exchange. The broker returns a short-lived, protected result to the client, which saves the credential in the OS-backed credential store.

Both paths use provider-specific endpoints and approved scope profiles. Miton validates state and uses PKCE wherever the provider supports it; OpenID Connect providers also use a nonce. Callback queries and tokens are not written to application logs.

What the broker does—and does not do

For brokered providers, the broker may temporarily handle an authorisation code and the token material needed for an exchange, refresh or revocation. It holds the handoff only long enough for the client to claim it, then deletes it on acknowledgement or expiry.

The broker does not retain long-lived provider tokens, proxy ordinary provider API traffic, or store provider tokens in a Miton account database. The client keeps the access and refresh credentials in its existing OS-backed credential store. Miton does not need an account or a cross-device token sync service for these integrations.

Disconnecting and reconnecting

  • Disconnect deletes the local credential, even if the provider’s remote revocation endpoint is unavailable. Remote revocation is attempted where that provider supports it.
  • Refresh replaces rotated access and refresh tokens atomically in the local credential store.
  • Reconnect required means a legacy beta credential has no registration profile. Miton will not refresh it with a different environment’s client registration; connect the provider again.

What to expect

  1. Choose Connect for a supported provider.
  2. Review the provider name and requested scopes in the system browser.
  3. Approve or cancel on the provider’s consent screen.
  4. Return to Miton and confirm that the connection is saved locally.

If a flow expires or is cancelled, no credential is saved. If you are unsure what a provider can access, cancel the consent screen and inspect its scope list before trying again.

What success looks like

The provider confirms consent, Miton returns to the connection screen, and the integration shows as connected after the credential is saved in the OS-backed credential store. A restart does not ask you to connect again unless the provider credential has expired or been revoked.

Common failures and recovery

  • The consent screen was cancelled: choose Connect again when you are ready. No credential is saved after cancellation.
  • The flow expired: restart the connection rather than reusing an old browser tab or callback.
  • The provider rejected the connection: review the requested scopes and any provider-side app or workspace permission, then reconnect.
  • Miton says reconnect required: the stored beta credential has no current registration profile; disconnect it and complete a fresh connection.