Integration OAuth in Sume: 10-minute state, one claim, admin recheck
Sume's connector OAuth state is random, user-bound and valid ten minutes. A cookie binds the browser, one callback claims it, and admin rights are rechecked.
When you click Connect on a Sume integration, the OAuth state is random, tied to your user and workspace, and valid for ten minutes. An httpOnly, SameSite=Lax cookie binds the browser. The callback claims the state exactly once, checks again that you are an admin of the original workspace, then exchanges the code with PKCE and saves the token.
Step by step
- Connect creates a random, ten-minute, user-bound and workspace-bound state, and sets the cookie.
- The provider sends the browser to
/api/integrations/{provider}/callback. - The callback atomically claims the state; a second use finds nothing.
- It validates admin membership again for the original workspace, not the currently selected Clerk organization.
- It exchanges the code with PKCE, discovers the permitted tools and saves the encrypted token.
Why the admin recheck matters
A person can lose admin rights, or switch organizations, while a consent screen is open. Checking at the callback against the workspace that started the flow stops a stale tab from granting access to the wrong place.
Why single claim
The callback must find the same pending transaction to complete. A disconnect, a new connect attempt or a switch to a demo removes or replaces it, so an old authorization cannot be resurrected later.
Return path
Sume derives the return path itself and never accepts one from a client. That avoids an open-redirect style abuse of the callback.
What you can do about it
If a Connect attempt fails or you waited too long on the provider screen, start over from the Integrations page; the old state is gone either way. For the client-side rules of Sume's hosted MCP login, which is a different OAuth server, see PKCE S256 only and the MCP OAuth flow.
Failure modes you may see
If you take more than ten minutes at the consent screen, the callback finds no valid state and the connect does not complete. If you open the callback in a different browser, the cookie binding fails. If you clicked Connect twice, only the latest pending transaction can complete.
None of these are bugs. They are the checks that keep a stolen or stale callback URL from attaching a provider account to a workspace.
Related posts
More in Integrations
- jobs_wait defaults to 50 seconds: how many calls for a long render
Remote MCP jobs_wait waits 50 seconds by default and 55 at most. A render that takes N minutes needs about N x 60 / 50 calls on the same ids. Never resubmit.
- kling-motion-control_create: motion_video_url, 1 to 30 s, no model
kling-motion-control_create needs a public HTTPS motion_video_url and duration_seconds of 1 to 30, and refuses a model field with provider_fields_not_accepted.
- Linear, Notion, GitHub in Sume: why there is no Connect button
Sume lists Linear, Notion and GitHub as coming soon because no reviewed read-tool allowlist or registered OAuth app exists in its stack for them yet.
- Linktree video background 50 MB limit: bitrate budget by length
Linktree video backgrounds loop with no time limit but a 50 MB cap. A 15-second loop can average 26.7 Mbps, a 60-second one 6.7 Mbps. Table and trim steps.
Written by Sume