How installation normally works
What a forward deployed engineer does by hand today.
An OAuth redirect. The account that authorizes is the account the deployment acts as, and the workspace it belongs to is read and recorded during the callback.
IntegrationsAsana
Asana is the strictest test of credential handling here. Access tokens last an hour and the refresh token rotates, so a single dropped replacement loses the customer's grant a day later, looking like something they did.
Your AI, MCP server or API

Their workspace and approved access
Their entitled capabilities and version
Validation, health and the next action
Available today
Ready for customer deployments with customer-scoped authorization, validation and lifecycle management.
What a forward deployed engineer does by hand today.
An OAuth redirect. The account that authorizes is the account the deployment acts as, and the workspace it belongs to is read and recorded during the callback.
The person whose calendar decides your go-live date.
Any Asana user who is a member of the workspace this is for.
Whose identity the product acts as, and where that grant lives.
OAuth 2.0 for one user, scoped in practice by the workspace recorded at installation. A token reaches every workspace that person belongs to, including personal ones, which is why the workspace is pinned rather than inferred per call.
The repeatable half, turned into software.
The OAuth flow, storing each rotated refresh token, refusing an exchange that returns no replacement, the recorded workspace, and revocation.
The half that is theirs and should stay theirs.
Their Asana workspace and the account that authorized it.
How capabilities map onto what the platform will let you do.
Granular scopes are opt-in per application. Meetext always asks for the narrow set, so an app without them grants more than was requested rather than less, and that difference is visible in the granted scopes rather than hidden.
What has to execute before anyone is told it works.
A real read of the recorded workspace's projects, plus a check that a refresh token was actually stored, because without one the install stops working within the hour.
Rotation, expiry, revocation, and who notices first.
Rotating. The replacement is stored on every exchange and an exchange without one is refused at the moment it happens rather than discovered as a dead grant the next morning.
What happens to this customer when you ship version four.
Per customer. Publishing does not move an installed workspace.
What actually goes wrong, named rather than generalised.
A first exchange that returns no refresh token, which is refused rather than recorded as an installation that expires in an hour.
How you learn it broke without the customer telling you.
Token validity and whether the rotating refresh token is still stored, which is the thing that breaks quietly here.
Ready for customer deployments with customer-scoped authorization, validation and lifecycle management.
Available for customer deployments, with customer-scoped authorization, validation and lifecycle management.
Connect a source, approve what ships and send your customer an install link. 2 customer environments free. No card required.