Add “Connect with Meg Secrets” to your app

Your users keep their keys and sign-ins in Meg Secrets. Your app gets a connection that can use them only on the hosts they approved. You never store a customer credential, so you have nothing to leak.

1. Register your app

Sign in, open Developer, and register your app with its redirect URI and what it needs. You get a client ID and secret.

2. Send the user to connect

Standard OAuth 2.1 with PKCE (S256):

https://secrets.getmeg.ai/authorize?client_id=mcc_…&redirect_uri=https://you.example/callback&response_type=code&state=…&code_challenge=…&code_challenge_method=S256

3. Exchange the code

POST https://secrets.getmeg.ai/oauth/token
grant_type=authorization_code&code=…&code_verifier=…&redirect_uri=…
(authenticate with your client ID and secret: HTTP Basic or form fields)

You get access_token (1 hour), refresh_token (one use; each refresh returns a new one), and grant_id. Reusing an old refresh token ends the connection for safety.

4. Make calls

POST https://secrets.getmeg.ai/v1/proxy
Authorization: Bearer mca_…
{"method":"GET","url":"https://api.stripe.com/v1/customers?limit=3","auth":{"need":"stripe"}}

Or put {{need:stripe}} wherever the credential goes. Meg Secrets fills it in, checks the host, removes the credential from the response and logs the call. Sign-in credentials are refreshed for you.

For agents: MCP

Point any MCP client at https://secrets.getmeg.ai/mcp with the access token as a Bearer token. Tools: list_needs, http_request, request_access, check_request.

Other endpoints

GET /v1/grants/me: what the connection can use and whether each credential is ready.
POST /v1/requests {"kind":"host","alias":"stripe","host":"files.stripe.com","reason":"…"}: ask the owner for more; poll GET /v1/requests/:id.
DELETE /v1/grants/me: disconnect.

Webhooks

Events: grant.created, grant.revoked, connection.expired, request.approved, request.declined. Each POST has a Meg-Signature: t=…,v1=… header: HMAC-SHA256 of t + "." + body with your webhook secret. Reject anything older than five minutes.

TypeScript SDK

import { MegConnect } from 'meg-secrets-connect-sdk';
const meg = new MegConnect({ baseUrl: 'https://secrets.getmeg.ai', clientId, clientSecret, redirectUri });
const { url, state, codeVerifier } = meg.authorizeUrl();
// …after the redirect:
const tokens = await meg.exchange(code, codeVerifier);
const conn = meg.connection(tokens, { onTokens: save });
const res = await conn.proxy({ url: 'https://api.stripe.com/v1/customers', auth: { need: 'stripe' } });

Connectors

Services are plug-ins (a manifest plus setup notes), so adding one needs no code change. For a service without a connector, list the hosts the key may be sent to in your need.