Nango AI Integrations: Unified OAuth and API Management for AI Agents

TL;DR — Nango is an open-source platform for building AI product integrations with managed OAuth, token refresh, and TypeScript functions. Nango: "You write integration logic as TypeScript functions, or let AI generate them for you, and deploy to Nango's production runtime. Nango handles auth, execution, scaling, and observability. Managed OAuth, API keys, and token refresh for 800+ APIs." Three primitives: Auth (OAuth + API keys + token refresh), Proxy (authenticated API requests), Functions (TypeScript integration logic). Nango blog: "AI agents interact with external APIs differently from traditional SaaS API integrations." Composio: "Nango excels at OAuth and credential management." Multi-tenant: per-connection credentials, encrypted storage, tenant isolation, self-hosting on Kubernetes/Docker. AI-generated integrations: describe what you need, AI writes the TypeScript function. Supports 800+ APIs including Slack, Gmail, GitHub, Google Drive, Jira, Notion. Integrate with Slack, Gmail, Google Drive, and GitHub.

Nango states its value proposition: "OAuth, API keys, and token refresh — handled for every API. Connect your product and agents to 800+ APIs, on infrastructure built for scale."

Nango's blog identifies the AI-specific challenge: "AI agents interact with external APIs differently from traditional SaaS API integrations. They need tool calls, not just data syncs. A unified API platform for AI agents must handle auth, tool calls, data syncs, webhooks, and observability."

Nango Architecture

Nango Primitives

Supported API Categories

Implementation

import httpx

class NangoIntegrationManager:
    """Manages AI agent integrations via Nango platform."""

    def __init__(self, nango_host: str, nango_secret: str):
        self.host = nango_host
        self.secret = nango_secret
        self.client = httpx.AsyncClient(
            base_url=f"{nango_host}",
            headers={"Authorization": f"Bearer {nango_secret}"},
        )

    async def create_connection(self, tenant_id: str, user_id: str,
                                provider: str, connection_id: str) -> str:
        """Initiate OAuth flow for a user to connect an external account."""
        # Create connection config
        response = await self.client.post("/api/connection", json={
            "connection_id": connection_id,
            "provider_config_key": provider,
            "tenant_id": tenant_id,
            "user_id": user_id,
        })

        # Return OAuth URL for user to authorize
        oauth_url = f"{self.host}/oauth/connect/{provider}?connection_id={connection_id}"
        return oauth_url

    async def get_credentials(self, connection_id: str) -> dict:
        """Retrieve stored credentials for a connection."""
        response = await self.client.get(
            f"/api/connection/{connection_id}"
        )
        return response.json()

    async def proxy_request(self, connection_id: str, method: str,
                            endpoint: str, data: dict = None) -> dict:
        """Make an authenticated API request via Nango proxy."""
        response = await self.client.request(
            method=method,
            url=f"/api/proxy/{endpoint}",
            headers={
                "Connection-Id": connection_id,
            },
            json=data,
        )
        return response.json()

    async def call_function(self, function_name: str,
                            connection_id: str, params: dict) -> dict:
        """Call a Nango integration function."""
        response = await self.client.post(
            f"/api/function/{function_name}",
            json={
                "connection_id": connection_id,
                "params": params,
            },
        )
        return response.json()

    async def list_connections(self, tenant_id: str) -> list:
        """List all connections for a tenant."""
        response = await self.client.get(
            "/api/connection",
            params={"tenant_id": tenant_id},
        )
        return response.json()

    async def delete_connection(self, connection_id: str) -> dict:
        """Revoke and delete a connection (user disconnects)."""
        response = await self.client.delete(
            f"/api/connection/{connection_id}"
        )
        return response.json()

    async def sync_data(self, connection_id: str, provider: str,
                        model: str) -> dict:
        """Trigger a data sync for a specific model."""
        response = await self.client.post(
            f"/api/sync/trigger",
            json={
                "connection_id": connection_id,
                "provider": provider,
                "model": model,
            },
        )
        return response.json()

    async def get_sync_records(self, connection_id: str, model: str,
                               cursor: str = None) -> dict:
        """Retrieve synced records with pagination."""
        params = {"model": model}
        if cursor:
            params["cursor"] = cursor

        response = await self.client.get(
            f"/api/sync/records/{connection_id}",
            params=params,
        )
        return response.json()

    async def register_webhook(self, connection_id: str, provider: str,
                               webhook_url: str) -> dict:
        """Register a webhook endpoint for external API events."""
        response = await self.client.post(
            "/api/webhook/register",
            json={
                "connection_id": connection_id,
                "provider": provider,
                "webhook_url": webhook_url,
            },
        )
        return response.json()

Nango Integration Function Example

// Nango integration function: Search Slack messages
// Deployed to Nango's runtime, callable by AI agents

export default async function searchSlackMessages(
  nango: NangoHttp,
  query: string,
  limit: number = 20
): Promise<SlackMessage[]> {
  // Nango handles auth automatically — no need for tokens
  const response = await nango.get({
    endpoint: "/search.messages",
    params: {
      query: query,
      count: limit,
    },
  });

  return response.messages.matches.map((match: any) => ({
    channel: match.channel.name,
    user: match.username,
    text: match.text,
    timestamp: match.ts,
    permalink: match.permalink,
  }));
}

// Nango integration function: Create Jira ticket
export default async function createJiraTicket(
  nango: NangoHttp,
  projectKey: string,
  summary: string,
  description: string,
  issueType: string = "Task"
): Promise<JiraTicket> {
  const response = await nango.post({
    endpoint: "/rest/api/3/issue",
    data: {
      fields: {
        project: { key: projectKey },
        summary: summary,
        description: description,
        issuetype: { name: issueType },
      },
    },
  });

  return {
    id: response.id,
    key: response.key,
    url: response.self,
  };
}

Nango AI Integrations Checklist

• [ ] Deploy Nango (cloud or self-hosted on Kubernetes/Docker)
• [ ] Configure provider credentials (OAuth client IDs/secrets for each API)
• [ ] Set up pre-configured OAuth for 800+ APIs
• [ ] Configure custom OAuth for APIs not in the catalog
• [ ] Implement connection creation flow (OAuth consent for users)
• [ ] Store connection_id per tenant and user
• [ ] Implement per-connection credential isolation (tenant-scoped)
• [ ] Encrypt all credentials at rest
• [ ] Implement automatic token refresh (handled by Nango)
• [ ] Use Nango Proxy for authenticated API requests
• [ ] Write TypeScript integration functions for custom API actions
• [ ] Deploy functions to Nango's production runtime
• [ ] Use AI to generate integration functions (describe → AI writes)
• [ ] Expose integration functions as tools for AI agents
• [ ] Set up webhook handling for external API events
• [ ] Configure webhook routing to your application
• [ ] Implement data sync for incremental data synchronization
• [ ] Configure sync schedules per provider and model
• [ ] Use cursor-based pagination for sync records
• [ ] Implement connection listing per tenant
• [ ] Implement connection deletion (user disconnects)
• [ ] Revoke credentials immediately on disconnection
• [ ] Support API key auth for APIs without OAuth
• [ ] Integrate with Slack via Nango
• [ ] Integrate with Gmail via Nango
• [ ] Integrate with Google Drive via Nango
• [ ] Integrate with GitHub via Nango
• [ ] Connect to company knowledge pipeline
• [ ] Log all integration events in audit logs
• [ ] Apply RBAC to integration access
• [ ] Apply multi-tenant connection isolation
• [ ] Apply zero-trust architecture to credentials
• [ ] Apply OWASP LLM Top 10 security controls
• [ ] Set up platform monitoring for integrations
• [ ] Monitor: connection count, sync latency, webhook delivery, error rate
• [ ] Handle Nango API rate limits and retries
• [ ] Consider BYOK for API key management
• [ ] Consider white-label branded OAuth flow
• [ ] Test: OAuth flow for each provider
• [ ] Test: token refresh after expiry
• [ ] Test: proxy requests with credentials
• [ ] Test: function execution and error handling
• [ ] Test: webhook delivery and routing
• [ ] Test: sync data accuracy and pagination
• [ ] Test: connection deletion and credential revocation
• [ ] Document supported providers and integration capabilities
• [ ] Consider AI incident response for integration failures

FAQ

What is Nango and how does it work with AI agents?

Nango is an open-source platform for building product integrations with AI. Nango: "You write integration logic as TypeScript functions, or let AI generate them for you, and deploy to Nango's production runtime. Nango handles auth, execution, scaling, and observability." It provides three primitives: (1) Auth — managed OAuth, API keys, and token refresh for 800+ APIs. (2) Proxy — authenticated API requests without managing credentials. (3) Functions — TypeScript-based integration logic deployed to Nango's runtime. For AI agents: Nango handles the OAuth flow, stores encrypted credentials, refreshes tokens automatically, and provides a unified API for agents to call external services. AI agents interact with external APIs differently from traditional SaaS — they need tool calls, not just data syncs. Nango supports this with its proxy and function primitives.

How does Nango handle OAuth for 800+ APIs?

Nango handles OAuth for 800+ APIs with a unified abstraction. Nango: "OAuth, API keys, and token refresh — handled for every API. Connect your product and agents to 800+ APIs, on infrastructure built for scale." Implementation: (1) Pre-configured OAuth — Nango has pre-configured OAuth flows for 800+ APIs (Slack, Gmail, GitHub, Google Drive, Jira, Notion, etc.). (2) Unified OAuth flow — one integration UI for all APIs, regardless of provider differences. (3) Token storage — encrypted credential storage with tenant isolation. (4) Automatic refresh — tokens are refreshed automatically before expiry, no manual intervention. (5) Custom OAuth — for APIs not in the catalog, configure custom OAuth settings. (6) API key auth — for APIs that use API keys instead of OAuth. (7) Webhook handling — Nango receives and routes webhooks from external APIs. This eliminates the need to build and maintain OAuth flows for each API individually.

How does Nango support multi-tenant credential isolation?

Nango supports multi-tenant credential isolation with: (1) Per-connection credentials — each OAuth connection is scoped to a specific tenant and user. (2) Encrypted storage — all credentials (OAuth tokens, API keys) are encrypted at rest. (3) Connection ID scoping — every API call includes a connection_id that maps to a specific tenant's credentials. (4) Tenant isolation — Tenant A's credentials are never accessible to Tenant B. (5) Self-hosting — for enterprises that need data sovereignty, Nango can be self-hosted on Kubernetes or Docker, keeping all credentials in your infrastructure. (6) Credential revocation — users can revoke access at any time, immediately invalidating stored tokens. Nango blog: "Tenant isolation, encrypted credential storage, and self-hosting options." This is critical for AI SaaS platforms where each tenant connects their own external accounts (Slack, Gmail, Drive).

How do AI-generated integrations work in Nango?

Nango supports AI-generated integrations where AI writes the integration logic for you. Nango: "You write integration logic as TypeScript functions, or let AI generate them for you." Process: (1) Describe the integration — tell Nango (or an AI coding tool like Claude Code) what API you want to integrate and what actions you need. (2) AI generates TypeScript function — the AI writes a TypeScript function that calls the external API, handling pagination, error handling, and rate limits. (3) Deploy to Nango runtime — the function is deployed to Nango's production runtime, which handles execution, scaling, and observability. (4) AI agent calls the function — your AI agent calls the Nango function as a tool, without needing to know the external API's details. This dramatically reduces integration development time — instead of reading API docs and writing custom integration code, you describe what you need and AI generates it.

How does Nango compare to other AI integration platforms?

Nango compares to other platforms: (1) Nango — open-source, 800+ APIs, managed OAuth, TypeScript functions, AI-generated integrations, self-hosting. Best for: teams that want control and flexibility. (2) Merge Agent Handler — unified API with MCP server generation, separate from traditional unified API. Best for: teams already using Merge. (3) Pipedream Connect — pre-built integrations with visual workflow builder. Best for: teams that want visual workflows. (4) Composio — agent-native SDK with actions + triggers, managed auth. Best for: AI-first teams. (5) Arcade — AI agent integration platform focused on tool calls. Composio: "Nango excels at OAuth and credential management, but most production AI agents need a managed auth → actions → triggers → sync layer." Nango's strengths: open-source, self-hosting, 800+ APIs, AI-generated integrations. Consider Composio if you need agent-native SDK with triggers.

Want a self-hosted AI company brain that does all of this out of the box?
Book a demo →