OAuth integrations

1. Integration driver — defines scopes, token URLs, feed fields, and dispatch logic.
2. Connection — a saved OAuth account (tokens + metadata) admins authorize once and reuse across forms.

​

Why two tiers?

​

Auth from a Connection

public function dispatch(
    FlexForm $form,
    FlexFormSubmission $submission,
    array $globalConfig,
    array $feed,
): IntegrationDispatchResult {
    $connection = $this->connectionFromFeed($feed); // your helper

    $token = app(OAuthTokenManager::class)->accessToken($connection);

    $client = $this->httpClient(bearerToken: $token);

    // …
}

• Client ID / Client secret (app registration)
• Optional default scopes
• Connection picker on the form feed (required)

​

Driver responsibilities

• getOAuthConfig() — authorize URL, token URL, scopes, redirect URI, uses_pkce (never includes client_secret)
• oauthClientId() / oauthClientSecret() — read credentials for token exchange / storage only
• usesPkce() — default true (S256); override only for legacy providers
• exchangeOAuthCode($code, $connectionId, $codeVerifier = null) — token exchange
• Tokens refresh via OAuthTokenManager (mutex + needs_reauth)

​

Studio UX

1. Admin registers the OAuth app (client ID/secret) under Integrations.
2. Clicks Connect account → redirect flow → new row in Connections.
3. On a form feed, selects Connection: Marketing Hub ([email protected]).
4. Field mapping and conditional rules behave like any other feed.