OAuth for every app, handled once.
Your users connect their accounts through Connect Link. Hoook stores the tokens, refreshes them, and never shows a credential to your code or your model.
refresh: 10 minutes before expiry revoked: pause calls, ask the user to reconnect secrets: encrypted, never returned to your code
1,134 tokens refreshed on their own today. Three users revoked access, and each was asked to reconnect.
Reconnect emails sentThe same integration, shipped.
Without Hoook
- Registering an OAuth app with every provider, one review at a time
- Encrypting, storing and rotating tokens for every user you have
- Refresh logic that breaks in a different way for each API
- Support tickets when an account quietly disconnects
With Hoook
- Use Hoook's OAuth clients, or bring your own where you want your brand
- Tokens encrypted at rest and scoped to one user and one app
- Refresh happens before expiry, for every account
- A webhook tells you when an account needs reconnecting
How a user connects an account
- 01
Request a connect token
Your backend asks Hoook for a short-lived token tied to your user's id.
connect.tsconst { token } = await hoook.connect.createToken({ userId: "u_42" })
→ open Connect Link inside your app
u_42 signs in to HubSpot · scopes: crm.objects.deals
✓ account apn_7Kx2 connected
await hoook.accounts.list({ userId: "u_42" })
[{ "app": "hubspot", "id": "apn_7Kx2", "healthy": true }]
- 02
Open Connect Link
Your user signs in to the app in a hosted window, or in your own UI with the frontend SDK.
connect.tsconst { token } = await hoook.connect.createToken({ userId: "u_42" })
→ open Connect Link inside your app
u_42 signs in to HubSpot · scopes: crm.objects.deals
✓ account apn_7Kx2 connected
await hoook.accounts.list({ userId: "u_42" })
[{ "app": "hubspot", "id": "apn_7Kx2", "healthy": true }]
- 03
Hoook keeps the account
Tokens are encrypted and refreshed. Your app keeps only the account id.
Managed auth Connected accountsWhich connected accounts need attention this week?Connected accounts8,412Refreshed today1,134Need reconnecting3Hoook · connected accountsrefresh: 10 minutes before expiry revoked: pause calls, ask the user to reconnect secrets: encrypted, never returned to your code
Tokens refreshed today, by app612Google318Slack204HubSpot3Revoked1,134 tokens refreshed on their own today. Three users revoked access, and each was asked to reconnect.
Reconnect emails sent - 04
Act on their behalf
Every tool call and proxy request runs with that account, and only that account.
proxy.ts// No prebuilt tool for this endpoint yet? Call it anyway.
await hoook.proxy.get({ userId, app: "hubspot",
path: "/crm/v3/objects/quotes" })
user's token attached · rate limit respected · logged
{ "results": [{ "id": "q_881", "status": "sent" }] }
const { token } = await hoook.connect.createToken({ userId: "u_42" })
→ open Connect Link inside your app
u_42 signs in to HubSpot · scopes: crm.objects.deals
✓ account apn_7Kx2 connected
await hoook.accounts.list({ userId: "u_42" })
[{ "app": "hubspot", "id": "apn_7Kx2", "healthy": true }]
What Hoook takes off your plate.
Multi-tenant by default
Each of your customers, and each of their users, holds their own connected accounts.
OAuth and API keys alike
The same flow works for OAuth apps, API key apps and basic auth.
Your brand, if you want it
Bring your own OAuth client so the consent screen shows your name.
The numbers behind agent integrations
Public documentation from the providers, and our own figures, each labelled with its source.
is how long a Google OAuth access token lasts, so every account your agent acts in needs refreshing all day.
Google Identity documentationto build, test and ship one production OAuth integration in-house, before it needs maintaining.
Hoook estimateconnected end users included on the Connect plan, then $2 for each one after that.
Hoook pricingBuilt for agents that act.
Credentials never reach the model
Your agent sees results, never tokens or keys.
Scoped per user
One user's account can never be used for another user's request.
Revocation noticed
If a user revokes access, the account is flagged before the next call fails.
No auth code to maintain
Provider changes to scopes and refresh rules are our problem.