Skip to main content
Some services, such as energy, banking or industry data providers, only share data after the account holder signs in on the service’s own page and approves access. This is called OAuth2. When the service isn’t in the connectors catalog, you can still connect it by asking the AI chat to build the sign-in flow with backend functions.
You need a Builder plan or higher to use backend functions.

​
Choosing the right option

Base44 has several ways to reach another service. Building your own sign-in flow takes the most work, so check whether one of the simpler options covers your service first. Pick the option that matches your service:
  • The service is in the connectors catalog: Use a connector. Base44 handles the sign-in, stores the tokens and keeps them fresh for you. An app user connector lets each person connect their own account. If a catalog connector asks for your own OAuth client, it’s still a connector, so you don’t need this page.
  • The service gives you an API key: Save the key as a secret and ask the AI chat to call the service from a backend function. To share one API across your workspace, use a custom OpenAPI integration.
  • The service needs OAuth2 sign-in and isn’t a connector: Build the flow with backend functions, as this page describes.
Custom OpenAPI integrations and MCP connections can’t connect each person’s own account. A custom OpenAPI integration sends the same sign-in details with every call, whoever is using your app. MCP connections you add are only for the AI chat while you build, not for your published app.

​
How it works

Base44 doesn’t store or refresh tokens for services outside the catalog, so your app does that work in its own backend functions. The AI chat writes them for you. A custom sign-in flow has 4 parts:
  • Connect button: A backend function sends the person to the service’s sign-in page, with a one-time code that ties the request to them.
  • Callback function: After they approve access, the service sends them back to a backend function in your app. It checks the one-time code and swaps the service’s reply for that person’s tokens.
  • Token table: The tokens are saved in a data table, one record per person. Only your backend functions read it, never your app’s pages.
  • API functions: Backend functions call the service with that person’s token, and use the refresh token to get a new one when it expires.
Your app needs people to log in, so it knows whose account each connection belongs to. Learn more in Managing login and registration.

​
Registering your OAuth app

Before your app can sign anyone in, you register it with the service. The service gives you a client ID and a client secret, and asks where to send people back after they sign in. That address is your callback function’s public URL. Each backend function has its own public URL, in this format:
Use the address people open your app on. If you’ve connected a custom domain, use that domain instead, for example https://your-domain.com/functions/yourFunctionName. If the service accepts more than one redirect URI, add both addresses. Choose the callback function’s name now, such as enedisCallback, so you can give the AI chat the same name later. To register your app with the service:
  1. Sign in to the service’s developer portal and create an OAuth app. Some services call it a client or an application.
  2. Enter your callback function’s URL as the redirect URI, for example https://your-app-name.base44.app/functions/enedisCallback.
  3. Choose only the scopes your app needs.
  4. Copy the client ID and client secret.
  5. Copy the service’s authorization URL and token URL from its developer docs.

​
Building the sign-in flow

The AI chat writes the functions, the token table and the buttons people click. Give it the details from the service’s developer docs, because it can’t look up a private service’s sign-in settings on its own.
Never type your client secret into a chat message. When the AI chat asks for it, enter it in the form the AI chat shows, or add it as a secret yourself. Base44 only detects and hides keys from well-known services, so a secret from another service stays in your message.
To build the sign-in flow:
  1. Go to your app editor.
  2. Ask the AI chat to build the flow, with the service’s URLs, your scopes and the callback function name you registered. For example:
  3. When the AI chat asks for your client ID and client secret, enter them in the form it shows.
  4. Check that the callback function has the exact name you registered. If it doesn’t, ask the AI chat to rename it.
  5. Click Dashboard.
  6. Click Data, then select the token table.
  7. Click Permissions at the top of the table, and check that only admins can create, read, update or delete records. Learn more in Changing data permissions.
  8. Click Test permissions in preview, then act as a regular user and check that they can’t see any records in the token table.

​
Publishing and testing

The service always sends people back to your published app, so the callback runs the version of the function you last published, with the secrets it had then. Publish your app before you test, and publish again whenever you change a function or a secret. To test the connection:
  1. Go to your app editor.
  2. Publish your app.
  3. Open your published app and log in.
  4. Click the connect button the AI chat added.
  5. Sign in to the service with an account you’re allowed to use, and approve access.

​
How people connect

Each person who logs in to your app connects their own account. They click the connect button, sign in on the service’s own page and approve access. Your app never sees their password for the service. Their tokens are saved in your app’s token table, which only your backend functions use. You and the other editors of your app can still see that table in your dashboard, so treat it like any other private data. Only ask people to connect accounts they own or are allowed to use, and only request the access your app needs. Tell them in your app what data you read and what you do with it. Some services, especially ones that share personal or household data, have their own rules about consent, so check the service’s terms before you publish.

​
Troubleshooting

If the sign-in flow doesn’t work, find your situation below.
The callback URL you registered with the service must match your function’s URL exactly. Check that it uses the same domain your app runs on, and that the function name matches its folder in Code, under base44/functions, including capital letters.
Publish your app, then try again from your published app. If it still fails, open the callback function’s file in Code, click Logs, and paste the error into the AI chat so it can fix the function.
The access token probably expires and isn’t being refreshed. Ask the AI chat to refresh it with the refresh token. Some services only send a refresh token when you request a specific scope or setting, so check the service’s docs.