---
title: "Get connected account auth credentials"
method: GET
path: "/api/v1/connected_accounts/auth"
tags: ["Connected Accounts"]
---

# Get connected account auth credentials

`GET /api/v1/connected_accounts/auth`

Retrieves complete authentication details for a connected account including OAuth tokens, refresh tokens, scopes, and API configuration. Query by account ID or by combination of organization/user, connector, and identifier. Returns sensitive credential information - use appropriate access controls.

## Query parameters

- `organization_id` string
- `user_id` string
- `connector` string
- `identifier` string
- `id` string

## Response `200`

Successfully retrieved connected account with full authentication details

- ConnectedAccountsGetConnectedAccountByIdentifierResponse
  - `connected_account` ConnectedAccountsConnectedAccount
    - `api_config` object — Optional JSON configuration for connector-specific API settings such as rate limits, custom endpoints, or feature flags.
    - `authorization_details` ConnectedAccountsAuthorizationDetails
      - `google_dwd` ConnectedAccountsGoogleDWDAuth — Google Domain-Wide Delegation authentication — used for GOOGLE_DWD connections. Send only subject in requests; access_token, scopes, and token_expires_at are response-only.
        - `access_token` string — OAuth access token acquired via the jwt-bearer grant. Present in responses only.
        - `scopes` string[] — OAuth scopes granted to this token. Present in responses only.
        - `subject` string — Email address of the Google Workspace user to impersonate via Domain-Wide Delegation.
        - `token_expires_at` string, date-time — When the access token expires. Present in responses only.
      - `oauth_token` ConnectedAccountsOauthToken
        - `access_token` string — OAuth access token for API requests. Typically short-lived and must be refreshed after expiration.
        - `domain` string — Associated domain for workspace or organization-scoped OAuth connections (e.g., Google Workspace domain).
        - `refresh_token` string — OAuth refresh token for obtaining new access tokens. Long-lived and used to maintain persistent authorization.
        - `scopes` string[] — List of granted OAuth scopes defining the permissions and access levels for this connection.
      - `static_auth` ConnectedAccountsStaticAuth
        - `details` object — Flexible JSON structure containing static credentials. Format varies by connector type (API key, username/password, etc.).
      - `trusted_idp` ConnectedAccountsTrustedIDPAuth — Trusted IDP federated authentication — used for TRUSTED_IDP connections (e.g. AWS Redshift). Send only db_user in requests; cached temporary credentials are managed server-side and returned only on output paths. secret_access_key and session_token are never exposed in public API responses.
        - `access_key_id` string — Federated access key ID issued by the trusted identity provider. Present in responses only.
        - `db_user` string — Target database user for the federated session (required for provisioned Redshift clusters; ignored for serverless workgroups).
        - `expiry` string, date-time — When the federated credentials expire. Present in responses only.
        - `secret_access_key` string — Federated secret access key. Never returned in public API responses.
        - `session_token` string — Federated session token. Never returned in public API responses.
    - `authorization_type` 'OAUTH' | 'API_KEY' | 'BASIC_AUTH' | 'BEARER_TOKEN' | 'CUSTOM' | 'BASIC' | 'OAUTH_M2M' | 'TRELLO_OAUTH1' | 'GOOGLE_DWD' | 'TRUSTED_IDP' | 'SMART_FHIR' | 'NO_AUTH' — - OAUTH: OAuth 2.0 authorization with access and refresh tokens - API_KEY: Static API key authentication - BASIC_AUTH: HTTP Basic Authentication (username/password) - BEARER_TOKEN: Bearer token authentication - CUSTOM: Custom authentication mechanism - BASIC: Basic authentication (alias) - OAUTH_M2M: OAuth 2.0 client credentials (machine-to-machine) - TRELLO_OAUTH1: Trello token-based OAuth1-style browser authorization - GOOGLE_DWD: Google Domain-Wide Delegation - TRUSTED_IDP: Trusted Identity Provider federation (e.g. AWS STS AssumeRoleWithWebIdentity) - SMART_FHIR: SMART on FHIR (SMART App Launch) — OAuth 2.0 authorization for FHIR servers - NO_AUTH: No authentication — connector requires no credentials (e.g. public docs MCP servers)
    - `connection_id` string — Reference to the parent connection configuration. Links this account to a specific connector setup in your environment.
    - `connector` string — Connector identifier (e.g., 'notion', 'slack', 'salesforce'). Indicates which third-party application this account connects to.
    - `id` string — Unique Scalekit-generated identifier for this connected account. Always prefixed with 'ca_'.
    - `identifier` string — The unique identifier for this account in the third-party service. Typically an email address, user ID, or workspace identifier.
    - `last_used_at` string, date-time — Timestamp when this connected account was last used to make an API call. Useful for tracking active connections.
    - `provider` string — OAuth provider name (e.g., 'google', 'microsoft', 'github'). Identifies which authentication service manages this connection.
    - `status` 'ACTIVE' | 'EXPIRED' | 'PENDING_AUTH' | 'PENDING_VERIFICATION' | 'DISCONNECTED' — - ACTIVE: Account is connected and credentials are valid - EXPIRED: Access token has expired and needs refresh - PENDING_AUTH: Account awaiting user authorization (re-auth initiated) - PENDING_VERIFICATION: OAuth complete; awaiting user identity verification before activation - DISCONNECTED: Account has been manually disconnected
    - `token_expires_at` string, date-time — Expiration timestamp for the access token. After this time, the token must be refreshed or re-authorized.
    - `updated_at` string, date-time — Timestamp when this connected account was last modified. Updated whenever credentials or configuration changes.

## Other responses

- `400` — Invalid request - missing required query parameters
- `401` — Authentication required - missing or invalid access token
- `404` — Connected account not found - no account matches the specified criteria

---

[API](https://skmtc.net/scalekit/apis/scalekit-api-reference.md) · [All operations](https://skmtc.net/scalekit/apis/scalekit-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalekit/scalekit-api-reference/versions/a40d5d4650e5/schema)