OAuth setup.

Redirect URI pattern: {origin}/api/oauth/callback/{provider} where provider is google, slack, or github. Register the localhost URI and your production URI on each app.

http://localhost:3000/api/oauth/callback/google
https://your-domain.com/api/oauth/callback/google
(same pattern for slack and github)

Google (Gmail + Calendar)

1. 1
   Enable APIs

   console.cloud.google.com → APIs & Services → Library → enable Gmail API and Google Calendar API.
2. 2
   Consent screen

   External · add yourself under Test users · add the Gmail (readonly/send/modify) and Calendar scopes. In Testing mode only listed test users can connect, and refresh tokens expire weekly. Publishing with Gmail scopes requires Google's verification process.
3. 3
   Create a Web client

   Credentials → Create OAuth client → Web application → add both origins and both redirect URIs → copy ID + secret into GOOGLE_CLIENT_ID/SECRET.

GitHub

1. 1
   Create OAuth app(s)

   github.com/settings/developers. GitHub allows one callback URL per app, so create two: a dev app (localhost callback) and a prod app (your domain's callback).
2. 2
   Set env

   Dev app → GITHUB_CLIENT_ID/SECRET; prod app → GITHUB_CLIENT_ID_PROD/SECRET_PROD. The app auto-selects by request origin.

Slack

1. 1
   Create the app

   api.slack.com/apps → OAuth & Permissions. Add User Token Scopes: chat:write, channels:read/history, groups:read/history, im:read/history, mpim:read/history, search:read, users:read.
2. 2
   Redirect URLs

   Slack requires HTTPS, it rejects http://localhost. Add your production URL, and for local dev tunnel with ngrok http 3000, add the ngrok URL as a redirect, and open the app through the ngrok origin when connecting.
3. 3
   Set env

   SLACK_CLIENT_ID/SECRET.

Until configured

• Unconfigured providers return a clear “not configured” message from the Connect button, nothing else breaks.
• Tokens live in users' browsers; your server only relays the code exchange and refreshes, statelessly.