Connecting API-key and custom-auth apps
Not every integration uses OAuth. Some apps authenticate with an API key or custom credentials, and the catalog's auth badge tells you which scheme an app uses before you start.
When an app uses credentials
For API-key and custom-auth apps, the connection flow prompts you for the required credentials rather than redirecting you to an OAuth consent screen. The credentials you enter are stored with the connection so the integration can be used afterward.
Auth schemes you may see
The Browse tab badges integrations by their auth scheme, including:
- API Key
- JWT (bearer/JWT-based)
- Basic
- No auth (for apps that don't require credentials)
How the connection is made
As with OAuth apps, the connect request is sent to a server-side route, and the Composio key that powers the integration is never exposed to your browser. Once the connection is established, the app appears in your Connected tab and its tools become available to Camelia and to flows.
Using the connection
After connecting, Camelia can run the app's read actions immediately. Any write action (such as creating, sending, posting, updating, or deleting) raises an approval popup before it runs, unless you've enabled auto-approval. This keeps you in control of changes the integration makes in your external accounts.
Keep your keys safe
App credentials entered during connection are handled server-side. If you instead want to supply your own Composio or OpenRouter key for the whole account, use the Credentials vault, covered in its own article.