Files
open-connector/docs/client-onboarding.md
shaun ce7ec59064 feat(web): onboard self-hosted clients and integrate OOMOL Key (#621)
## Summary

This change gives users a complete path from a deployed OpenConnector
gateway to using its Actions from an agent, a terminal, or application
code. It also integrates the optional OOMOL Key experience into provider
discovery and configured connections.

The console previously exposed MCP configuration and protocol
references, but CLI and SDK setup remained scattered across repository
documentation. The Action page's TypeScript example used raw HTTP rather
than the Connector SDK, and users had to replace gateway URLs and
connection names themselves. The standalone Marketplace page also
separated managed service discovery from the provider workflow.

## Changes

- Put **Discover connections** before **Configured connections**, with
OOMOL Key services identified as built-in accounts after activation and
separate source filters for built-in accounts and user credentials.
- Move optional OOMOL Key discovery into the provider page. Keep
supported services in a compact responsive grid with visible discounts,
and show the exact supported Actions in an operation drawer.
- Separate service expansion from the Key connection dialog. Users can
inspect services, connect or remove a Key, and hide the recommendation
without changing their own provider credentials.
- Consolidate language, theme, runtime refresh, and the OOMOL Key entry
in a top-right settings panel. Restore the product overview before
asking for a Key. Use shadcn Sonner for the hide notification and undo
action.
- Replace the Resources page with a three-stage client onboarding guide:
confirm the gateway URL and Runtime Token requirements, choose
MCP/CLI/SDK, and run the first Action. Changing the URL updates the
client examples and Action examples in the same console session.
- Add genuine CLI and OpenConnector SDK examples to Action details,
including named-connection selection. Retain cURL, HTTP TypeScript, and
agent examples.
- Add English and Simplified Chinese standalone onboarding guides, link
them from the READMEs, update SDK connection-management documentation,
and localize the console flow in all six supported languages.

## Build resilience

During verification, the existing remote provider icon catalog returned
HTTP 404 and prevented an otherwise valid Web build. The icon plugin now
applies a bounded fetch and emits a warning with an empty optional
mapping on failure. Provider-defined icons and the existing initials
fallback remain available, and a valid remote catalog still bundles
normally. Regression tests cover both cases.

## Verification

- `npm run fix-check` — passed lint fixes, formatting, and type checking
for src/scripts/examples.
- `npm run generate:catalog` — regenerated the current catalog and
registries after rebasing onto main.
- `npm run build:web` — passed with the remote-catalog warning and
normal icon fallback.
- `npx vitest run web/src --reporter=dot` — 21 files, 168 tests passed.
- `git diff --check` — passed.
- Browser checks covered gateway URL propagation into MCP/CLI/SDK and
Action examples, independent Key dialogs and service expansion, service
operation drawers, and Sonner hide/undo behavior.
- An installed oo CLI reached the local gateway and returned
`{"dryRun":true,"ok":true}`. Actual Hacker News retrieval was blocked by
this machine's upstream DNS resolving to a reserved address; the
existing egress protection was left intact.

## Base

Rebased onto the latest `origin/main` (`70a6f779`) without conflicts.
The earlier local UI commits are included in this PR, together with the
client onboarding work.
2026-09-28 18:07:05 +08:00

5.3 KiB

Use your self-hosted gateway from a client

After deploying OpenConnector, open Connect clients in the Web Console. It provides MCP, CLI, and SDK examples that use your gateway address. Changing that address also updates the examples on Action detail pages during the same console session.

1. Choose the gateway address and token

Use an address reachable from the device running your client, such as https://connect.example.com. localhost refers to that client device, so it works only when the gateway is on the same machine. CLI and SDK use the base URL; MCP appends /mcp. Do not append /v1 yourself.

If the gateway requires authentication, create a Runtime Token on its API Key page. Grant the Actions and connections that this client needs. Replace <RUNTIME_TOKEN> in the examples below. For a runtime without authentication, omit the token.

These credentials serve different purposes:

  • Runtime Token: authorizes your client to call your self-hosted gateway.
  • OOMOL Key: enables OOMOL-hosted services inside the gateway.
  • Provider credentials: connect your own provider accounts; these stay on the gateway.

2. Connect a client

MCP: agent clients

Add this server to an MCP client supporting remote HTTP servers and Authorization headers:

{
  "mcpServers": {
    "open-connector": {
      "url": "https://connect.example.com/mcp",
      "headers": { "Authorization": "Bearer <RUNTIME_TOKEN>" }
    }
  }
}

For unauthenticated runtimes, remove headers. The endpoint supports stateless POST JSON-RPC; it does not provide a persistent GET SSE stream.

Ask the agent to use search_actions to find an Action, then get_action_guide to inspect its contract. Use list_connections when you need to choose an account, and execute_action to run it. A first call requiring no provider credentials is:

{ "actionId": "hackernews.get_top_stories", "input": {} }

CLI: terminals, scripts, and local agents

Install oo on the client device:

curl -fsSL https://cli.oomol.com/install.sh | bash

Windows PowerShell:

irm https://cli.oomol.com/install.ps1 | iex

Set the target in the same terminal. Environment configuration has the highest priority, including when OO_API_KEY or a saved hosted account is present:

export OO_CONNECTOR_URL='https://connect.example.com'
export OO_CONNECTOR_TOKEN='<RUNTIME_TOKEN>'

oo connector search "top stories"
oo connector schema hackernews.get_top_stories
oo connector run hackernews --action get_top_stories --data '{}'

For an unauthenticated runtime, leave OO_CONNECTOR_TOKEN unset. In PowerShell, set environment variables using $env:OO_CONNECTOR_URL and $env:OO_CONNECTOR_TOKEN.

You can also save a gateway for later sessions:

oo connector login https://connect.example.com --token '<RUNTIME_TOKEN>'

OO_CONNECTOR_URL overrides saved configuration. OO_API_KEY also outranks saved self-hosted configuration, so use OO_CONNECTOR_URL when you need to select your gateway explicitly. These connector commands do not require signing in to an OOMOL account. Other hosted oo capabilities use their own OOMOL authentication.

SDK: application code

Install the TypeScript client:

npm install @oomol-lab/connector
export OOMOL_CONNECT_RUNTIME_TOKEN='<RUNTIME_TOKEN>'

Use OpenConnector for the self-hosted runtime:

import { OpenConnector } from "@oomol-lab/connector";

const gateway = new OpenConnector({
  baseUrl: "https://connect.example.com",
  runtimeToken: process.env.OOMOL_CONNECT_RUNTIME_TOKEN,
});

await gateway.health();
const matches = await gateway.catalog.search("top stories");
const action = await gateway.catalog.action("hackernews.get_top_stories");
const result = await gateway.execute("hackernews.get_top_stories", {});
console.log(result);

The SDK sends requests; provider execution and credentials stay on the gateway. The separate Connector and ProjectConnector clients target OOMOL-hosted personal and project workflows.

3. Use your own services

Once the first call succeeds, configure a provider in the Web Console, find an Action on the Actions page, inspect its schema, and copy its CLI or SDK example. The examples use your selected gateway address and connection name. Replace example values with your own business inputs.

Select a named connection in the CLI:

oo connector apps github
oo connector run github --action get_current_user --connection-name work --data '{}'

Select it from the SDK:

await gateway.execute("github.get_current_user", {}, { connectionName: "work" });

For actions that return a task ID, use the provider's result/status Action to follow progress. The self-hosted CLI integration does not expose --wait / --wait-result lifecycle handling.

If a call fails, check the gateway's Run logs and the client's error response. Verify that the Runtime Token grants the selected Action and connection, and that the provider is connected. executeRaw also returns an execution ID for SDK callers.

More detail