Third-Party Integrations APIs
Let your users connect their own third-party accounts — GitHub, Slack, Google Calendar, Strava, and roughly two thousand others — and have the model use them as tools inside a conversation.
Account connection is handled by Pipedream Connect. You never see, store, or refresh the user's third-party credentials: they are held by Pipedream and the platform addresses them by an identifier it derives for each of your users.
Everything is scoped to the calling user
There is deliberately no user identifier in any request body. The user is derived
server-side from the gateway-verified x-user-id / x-tenant-id headers, so a caller
can only list, connect, and disconnect their own accounts — there is no way to address
someone else's. delete-account rejects an account id that is not the caller's own, and
reports it as not found rather than confirming that it exists.
Field naming
Request bodies accept either snake_case or camelCase — both parse. Response
bodies are always camelCase (nameSlug, connectLinkUrl, pageInfo), because
responses are encoded with protojson. Fields that are unset, empty, zero, or false are
omitted from the response entirely rather than sent as null — read them with a
default, not a presence check.
Pagination
List endpoints are cursor-paged. Pass pageInfo.endCursor from one response as after
on the next request, and stop when a page comes back with no data. limit caps the
page size.
All endpoints use POST /api/v1/integrations/pipedream/<method> with a JSON request body.
Authentication
- API Key: apiKeyAuth
- API Key: onBehalfOf
- HTTP: Bearer Auth
Your API key. sk_… for backend-to-backend calls, pk_… for client apps.
Never valid on its own — see the combinations under Security below.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-API-Key |
The end user this call acts for. Required with an sk_… key, because a secret
key identifies your tenant and not a user; omitting it returns
401 authenticated user_id is required. The key needs the users:impersonate
scope or the call fails with 403 insufficient_scope.
Security Scheme Type: | apiKey |
|---|---|
Header parameter name: | X-On-Behalf-Of |
The end user's own JWT, issued by the OIDC provider configured on the
publishable key. Required alongside a pk_… key, and supplies the user
identity in place of X-On-Behalf-Of.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | JWT |