Service configs

Some connectors and MCP servers sign in through your own OAuth client rather than a stored key, Sign in with Google for BigQuery, Snowflake OAuth for Snowflake, OAuth M2M for Databricks. A service config holds those shared OAuth client credentials once, so everything using that method reuses them. Found at Settings > Integrations > Service Configs.

Prerequisites

• Admin role at the tenant level.

• An OAuth client registered with the provider (client ID and secret).

Why they exist

Without a service config, each person connecting a BigQuery source via Sign in with Google would need their own OAuth client. The service config lets an admin register the client once; connections then reference it and users just authorize.

Available services

The Available Services section lists every service that can take a config. Each card shows the service and its category, and reveals a badge when you hover it: Configure for a service with no config yet, Add another for one that already has at least one. A service can hold more than one client, for example one per environment. Services fall into two categories.

Service	Category	What it is for
Google BigQuery OAuth	Data Source	OAuth 2.0 client credentials for connecting to Google BigQuery as a Google user (3-legged consent flow)
Snowflake OAuth	Data Source	OAuth credentials for Snowflake connections
Databricks OAuth M2M	Data Source	OAuth machine-to-machine credentials for Databricks
Databricks Azure SP	Data Source	Azure Service Principal credentials for Databricks
Google Drive	MCP Server	OAuth app credentials for the Google Drive MCP server
HubSpot	MCP Server	OAuth app credentials for the HubSpot MCP server
Zoom	MCP Server	OAuth app credentials for the Zoom MCP server

A card marked Platform default available already has a fallback client Adverity provides, so configuring your own is optional for that service.

Note

The MCP server entries are here because those providers do not support dynamic client registration. The rest of the MCP catalogue registers its client automatically and needs no service config.

Setting one up

1. Register the client: With the provider

2. Configure the service: In Adverity Atlas

3. Use it: When adding a source or server

In detail:

1. Register an OAuth client with the provider (for BigQuery, a Web application credential in Google Cloud Console). Register https://<your-atlas-host>/oauth2/callback/ as its redirect URI, trailing slash included. Every OAuth sign-in in Adverity Atlas returns to this one address. If your installation routes sign-ins through an OAuth redirect proxy, register the proxy callback URL your Adverity Atlas operator gives you instead.

2. Go to Settings > Integrations > Service Configs. Under Available Services, click the card for the service you want. A Configure <service> panel opens.

3. Fill in the fields below and click Save Config. The config appears in the table above with its Status.

4. The config is now an option when someone adds a data source or MCP server using that authentication method.

Note

An authorization link works once and only for a few minutes, and only on the Adverity Atlas address the sign-in started from. If a sign-in ends on “This authorization link has expired”, go back to where you started and start again.

Fields

The panel shows only the fields that apply to the service you picked.

Field	Description
Name	How the config appears when someone picks it while adding a data source or server	Required
Client ID	OAuth application client identifier	Required
Client Secret	OAuth application client secret, stored encrypted	Required
Azure Tenant ID	Azure Active Directory tenant identifier. Databricks Azure SP only	Required
Scopes	Space-separated OAuth scopes to request during authorization. MCP server services only	Optional
Authorization URL	The provider’s authorize endpoint	See below
Token URL	The provider’s token endpoint	See below

Each URL field shows the provider’s own endpoint as a placeholder, or “Default from connector” where there is none. A placeholder is a hint, not a value, so a field left blank stays blank. How much you have to type depends on the service:

Service	Authorization URL	Token URL
Snowflake OAuth	Required, and must be on your Snowflake account host	Required, and must be on your Snowflake account host
Databricks OAuth M2M	Not shown, there is no consent step in a machine-to-machine flow	Required. https://<workspace-host>/oidc/v1/token, where the host is your workspace’s hostname, e.g. dbc-....cloud.databricks.com. The panel repeats this under the field. Databricks data sources using this client take their Host from it, so it has to be this workspace-level form
Databricks Azure SP	Not shown, there is no consent step in a machine-to-machine flow	Required, it embeds your Azure tenant ID. Data sources do not call this URL: the Databricks driver builds its own Entra ID token endpoint from the Azure Tenant ID field, so a typo here cannot break a connection and fixing one will not repair it
Google BigQuery OAuth, Google Drive, HubSpot, Zoom	Optional, overrides the default	Optional, overrides the default

Note

Snowflake rejects an endpoint that is not on your own account host, so Adverity Atlas checks both URLs end in snowflakecomputing.com (or snowflakecomputing.cn) before saving.

Managing an existing config

The table lists Name, Type, and Status. Click a row to reopen it, then Update to save changes, or use the row menu to Verify or Delete it.

Verification

For services that support it, Adverity Atlas checks a config against the provider’s own token endpoint, without anyone going through a sign-in. How depends on the kind of client. For a client people sign in through, such as Snowflake OAuth, it asks the endpoint to redeem an authorization code that was never issued; a provider that rejects the code rather than the client has just confirmed that the Token URL, Client ID and Client Secret are all right. For a machine-to-machine client, such as Databricks OAuth M2M, there is no sign-in to imitate, so the check is the real thing: Adverity Atlas requests an access token with the client’s own credentials and discards it. The check starts on its own when you save a config, and you can run it again any time from the row menu.

Status	Meaning
Verified	The provider accepted the client. Hover for when.
Verifying	The check is running. The table refreshes by itself.
Verification failed	The provider refused, and the reason is shown under the badge, for example “Invalid client credentials (error code: invalid_client)” or “Could not reach the authorization server: …”. Fix the config and save it to check again.
Not verified	Never checked, or the credentials or Token URL changed since. Services without a check stay here.

Verification covers Snowflake OAuth, Google BigQuery OAuth and Databricks OAuth M2M. It proves the token endpoint and the client credentials. For Snowflake and Google, whether the redirect URI is registered with the provider only shows at the first sign-in. For Databricks, whether the service principal may use a particular SQL warehouse only shows at the data source’s connection test. Every other service type stays at Not verified, since there is nothing it can check without a sign-in.

For Google, a “Verification failed” reading “invalid_request” with a message about Google’s OAuth 2.0 policy means Google refused the instance’s own callback address before it looked at the client, which only happens when the instance is not reachable under a real public hostname; the config itself is not the problem.

The state follows the config into the Add a data source wizard: the OAuth client pick on the Authenticate step shows it next to each client’s name unless the client is verified, and the Review & create step warns, with the reason and a link back here, when the client you picked failed.

Warning

Deleting a config breaks every data source and MCP server that authenticates through it. Repoint them first.

Secrets behave the way they do everywhere in Adverity Atlas: a stored secret is never shown again, and an edit form leaves the field blank with “Leave blank to keep existing value”.

Permissions

Tenant Admin only.

What’s next?

• Data sources, connect a source that uses one of these configs

• MCP servers, register a server whose provider needs one

• AI providers, the other half of Integrations

Was this page helpful? Yes No