Connecting gateways

Some Odel gateways relay services that need you to sign in — GitHub, Asana, and other servers that authorize with OAuth. When an application (an MCP client such as Claude Code, Cursor, or the MCP Inspector) connects to such a gateway on your behalf, Odel first has to hold a connection to that service for you.

If it doesn't have one yet, you land on the Connect gateway page in the middle of the application's sign-in. This page explains exactly what that page does.

What the page tells you

• Which application started the connection. The name and logo are supplied by the application itself when it registers with Odel — they identify it, they don't vouch for it. If you didn't just click "connect" in that application, close the page.
• Which account the connection is for. The connection you make is tied to the Odel account you're signed in with, and to nobody else — a teammate using the same gateway connects separately.
• Which gateway, by name and by its @owner/name address.
• Each service the gateway relays, whether you're already connected to it, and — for the ones you aren't — where you'll be sent to sign in and which permissions that sign-in will request.
• When the request expires. The application's authorization request is only valid for ten minutes. If the sign-in takes longer, you'll be asked to retry from the application; the connection you made is kept, so the retry completes immediately.

Nothing happens until you click Connect. There is no automatic redirect to a third party.

What happens when you click Connect

1. Your browser goes to the service (for example github.com). You sign in there — Odel never sees that password — and approve the OAuth app the gateway's owner registered with that service.
2. The service sends your browser back to Odel with a one-time code. Odel exchanges it for an access token (and, where the service issues one, a refresh token).
3. The tokens are stored in Odel's secrets service, encrypted at rest, under an address that names your account and this gateway. They are read only by the gateway proxy, only when the gateway relays a request you make. They are never shown to you, to the gateway's owner, or to the application.
4. You return to the Connect page. If the gateway relays more than one such service, you connect the next one the same way.
5. Once every service is connected, the sign-in resumes where it left off: Odel's own consent screen, where you approve the application's access to this gateway. That approval is remembered per gateway, so you won't see it again for the same application and gateway.

From then on, the application talks to the gateway with a token that is valid for this gateway only, and the gateway relays your requests to the service using the connection you made.

What Odel never does

• It never sees or stores your password for the service.
• It never uses your connection for anyone else's requests.
• It never uses your connection for another gateway, even one relaying the same service.
• It never sends you to a service automatically — every hop to a third party is a button you click.

Disconnecting

• On the service side: revoke the app in the service's authorized-applications settings (on GitHub: Settings → Applications → Authorized OAuth Apps). The next time the gateway tries to use the connection, the service refuses it. Odel then discards the stored tokens and ends the application's standing access to that gateway; the application is told to sign in again on its very next request, which brings you back to the Connect page.
• On the Odel side: revoke the application's access from your account's connected applications. The application will have to sign in again, and the gateway will ask you to connect the service again only if its connection is also gone.

Why the request can expire

The application's authorization request is signed and time-limited so that a stale or replayed request can never complete a sign-in. Ten minutes is enough to sign in at a service and approve an app; if it runs out, retrying from the application is safe — every connection you finished is kept.