# How Glow Integrations Work

> See how the Glow integration framework connects the app catalog, accounts, Steps, triggers, and AI agent tools.

Glow runs a native integration framework for app authentication, action execution, and trigger handling. Connect an account once, reuse it across canvas Steps and AI Agent tools, and inspect every response in **Executions**.

**At a glance**

- **Use it to:** Understand how app connections, pre-built actions, Custom API requests, triggers, and AI Agent tools work together
- **Find it:** Canvas App drawer → Apps and Left sidebar → Connections
- **Output:** App actions return their result directly as {{ N.field }} · Custom API request returns {{ N.status }}, {{ N.headers }}, and {{ N.data }}
- **Instead:** HTTP Request Step (for arbitrary external APIs outside a catalog app)

## How the Parts Fit Together

The app catalog defines available operations and input fields. A saved connection supplies account authorization, and each Step supplies the operation and mapped inputs.

> Configure an action and connected account, execute it against the external app, then inspect the Step output and map it downstream. See the [integration framework diagram](https://docs.getglow.ai/manage/apps-and-integrations/how-integrations-work) on the web version of this page.

App Catalog → Configured Step → [Executions Output](https://docs.getglow.ai/build/core-concepts/executions)

  

**From Catalog to a Configured Step**

    Pick an action in the App drawer, select its **Connection**, and fill in its fields. Resource pickers load live items (such as spreadsheets or channels) through the selected account. Multiple Steps can share one account while targeting different resources. If you switch the selected account, recheck dependent resource fields.

  

  

**From an Event to a Result**

    A trigger starts the automation when an app event arrives or when you click **Run**. Connecting an account alone never starts event delivery. At runtime, Glow resolves mapped inputs and calls the service with the selected account. It then stores the response in **Executions** for downstream Steps.

  

## Where AI Fits

**Workflow Assistant** (Build time)

- Assembles and edits Steps on the canvas.
- Review its Steps, account bindings, and field mappings before running.
- Authorized tests execute real actions. See Build with Workflow Assistant (/build/ai-features/workflow-assistant).

**AI Agent** (Run time)

- Calls permitted app tools during execution using granted accounts.
- Tool results return to the agent; later Steps read the AI Agent output.
- App triggers are event sources, not agent tools. See Configure an AI Agent (/build/ai-features/ai-agent).

> **Access and approval are separate.** Granting account access does not pause
> every tool call for human approval. Check account and tool approval settings,
> or add a [Human Review](https://docs.getglow.ai/build/action-steps/user-approval) Step before
> sensitive actions.

## Choose the Connection Method

| You need to…                                      | Use                                                  | Who supplies authentication?                                   |
| ------------------------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------- |
| Perform an operation listed for an app            | A pre-built app action                               | Select a saved app connection                                  |
| Call another endpoint of a supported app          | The app's **Custom API request**, where available    | Glow applies the selected connection's credentials             |
| Call your own or another public API               | [HTTP Request](https://docs.getglow.ai/build/action-steps/http-request)     | Configure authentication using workspace secrets or API keys   |
| Start an automation when a service sends an event | An app trigger or [Webhook](https://docs.getglow.ai/build/triggers/webhook) | Complete the trigger's setup or configure webhook verification |

## What Glow Manages

| Layer                         | What Glow handles                                                                                       | What you verify                                                                                                                                                                     |
| :---------------------------- | :------------------------------------------------------------------------------------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Authorization & accounts**  | Saves connections, refreshes OAuth tokens when a valid refresh token is provided, and updates in place. | Test access to the target resource and check dependents in **Connections** ([Managing Connections](https://docs.getglow.ai/manage/apps-and-integrations/managing-connections#disconnecting-a-connection)). |
| **Configuration & execution** | Loads dynamic pickers, resolves mapped inputs at runtime, and logs output in **Executions**.            | Select parent resources before child fields, and map actual output fields (`{{ N.field }}`).                                                                                        |
| **Incoming events**           | Polls for new records or receives webhooks through the integration's trigger mechanism.                 | Complete required provider subscriptions or bot permissions before switching to **Live**.                                                                                           |

- **Direct output on app Steps:** App actions expose their return value directly (object, list, or scalar), whereas [HTTP Request](https://docs.getglow.ai/build/action-steps/http-request) has its own output wrapper. Adobe PDF Services Steps (`Extract Text From PDF` and `Extract Text and Tables From PDF`) return extracted `text`, `elements`, and `tables` directly, with the full archive under `archiveFile` (up to 10 MB).
- **Slack posting & loop protection:** Slack Steps that send to a channel post as **Glow** by default (with **Send as Bot** enabled on new **Post Message** Steps) unless **Send as User** is turned on. If Glow is not in the channel, it joins automatically using your Slack access or asks you to run `/invite @Glow` (or turn on **Send as User** for direct messages). Messages posted as Glow do not trigger your Slack triggers.
- **No charge when nothing reached the app:** When an app Step fails on Glow's side before anything is sent to the external service, the Step reports `"Glow had a problem running this step"`, confirms nothing was sent, and costs `0` Step credits (`Failed - not charged`).
- **Polling baselines & intervals:** Resuming a paused polling trigger sets a fresh baseline without replaying events created while paused. Gmail triggers check for new mail every minute on paid plans (every 5 minutes on Free).
- **Connections and webhooks are separate:** Saving a connection does not configure an inbound [Webhook](https://docs.getglow.ai/build/triggers/webhook) trigger.

## [Choose Your OAuth App Registration](https://docs.getglow.ai/manage/apps-and-integrations/how-integrations-work#use-your-own-app-registration)

**Default Glow OAuth App** (Built-in setup)

- Sign in immediately using Glow's managed OAuth client where available.
- Used automatically when no workspace or MSP registration is configured.
- No developer-console redirect URL or client secret setup required.

**Use Your Own App (Workspace or MSP)** (Custom identity)

- Use an OAuth client managed by your workspace or MSP organization.
- Precedence at sign-in: workspace registration, then MSP, then Glow.
- Admin saves Client ID and Client secret via Use your own app in sign-in setup.

Saving a custom registration updates the OAuth client identity for new sign-ins and reconnections. It does not add per-automation scope selectors or reauthorize existing connections. Follow [Use Your Own App](https://docs.getglow.ai/manage/apps-and-integrations/credentials#use-your-own-app) for setup, rotation, and removal.

## [Make a Custom API Request](https://docs.getglow.ai/manage/apps-and-integrations/how-integrations-work#make-a-custom-api-call)

Use an app's **Custom API request** action to call an allowed endpoint not covered by pre-built actions. It reuses your saved connection without exposing its raw token.

### Select the app and account

Add **Custom API request** from the app's actions and select the intended **Connection** in the App drawer.

### Configure the request

Set **Method**, **URL** (a relative path or allowed HTTPS URL), **Query parameters**, **Headers**, and **Body**. Glow injects authentication from the selected connection. Use headers only for request metadata.

### Check a read before a write

Run an authorized test with a small `GET` request first (ordinary **Run step** replays saved test data). Inspect `{{ N.status }}`, `{{ N.headers }}`, and `{{ N.data }}` (for example, `{{ 2.data.id }}`). Then test writes against a safe test resource.

Initial requests must target an allowed API host for that app. Cross-origin redirects strip credential headers, though redirects can still forward a request body. Check redirect behavior before sending sensitive payloads. Check the external service before retrying a timed-out write.

## Review Access and Data Handling

- **Isolate client accounts:** Keep each client's connections in its own workspace. Recheck bindings when deploying across workspaces.
- **Audit provider scopes:** Review OAuth consent screens and API-key scopes against your policy.
- **Protect secrets:** Raw credentials are never returned in connection details. Use workspace Secrets or API keys for manual auth headers.
- **Check retention:** Responses enter execution history and downstream Steps. Review [Security & Compliance](https://docs.getglow.ai/manage/workspace-settings/security-compliance) and ask your account team for subprocessor, region, or audit documentation.

**Verify it works**

- **Run:** Add an app Step or Custom API request, select a saved Connection, and run a read-only test
- **You should see:** Glow calls the external service with the selected account and records the returned output in Executions.

## What's Next?

- [Connecting an App](https://docs.getglow.ai/manage/apps-and-integrations/connecting-an-app): authorize an account and check access with a read-only action.
- [Managing Connections](https://docs.getglow.ai/manage/apps-and-integrations/managing-connections): reconnect, replace, or retire an account.
- [HTTP Request](https://docs.getglow.ai/build/action-steps/http-request): configure a request to another public API.