OAuth Readiness
Back to all apps

Airtable

Generated live by the research agent (Gemini), checked 2026-10-19. Setup not tested by hand.

Airtable provides an entirely self-serve OAuth integration process that does not require an approval or app review from Airtable. To enable external users to authorize your integration, you only need to configure your redirect URI, scopes, support email, terms of service URL, and privacy policy URL.

Tier 1: Instant

Hands-on work
1–3 hours
Waiting for approval
Unknown
Confidence
high

Assumes: A public AI agent product requesting standard scopes (such as data.records:read and data.records:write) so external users can connect their Airtable bases.

10 min1 hour1 workday1 week1 month6 months

Solid dark bar: your hands-on work. Amber: the minimum wait. Hatched: the range sources disagree on, or an open-ended wait.[1][2]

Recurring: Refresh OAuth access tokens every 60 minutes using the refresh token flow, handling invalidation and storing the newly returned access and refresh tokens.[2]

Why tier 1? Nothing gates this path.
The tier is computed from these seven facts by a fixed rule, not chosen by the AI. High: the gates that set this tier are backed by the provider's own docs or our own test.
Self-serve credentialsYesDevelopers can self-serve register new OAuth integrations, obtain client IDs, and generate client secrets directly at /create/oauth.[1][2]
Limits until reviewedNoNot mentioned in the official process: no connection caps, user limits, or warning screens are documented for unreviewed apps, though other users cannot authorize until public URLs are filled in.[1][2]
Provider reviewNoNot mentioned in the official process: distributing an integration to external users only requires setting a support email, privacy policy URL, and terms of service URL in the management page without any manual review or approval from Airtable.[1][2]
Security assessmentNoNot mentioned in the official process: no mandatory third-party or internal security audit is mentioned.[1][2]
Business verificationNoNot mentioned in the official process: no business verification or legal entity checks are required to create and distribute integrations.[1][2]
Mandatory feesNoNot mentioned in the official process: registering and using OAuth integrations does not incur developer fees.[1][2]
Partner or paid accessNoNot mentioned in the official process: standard OAuth registration is open self-serve to any user at /create/oauth.[1][2]

You can start today without any of this. Composio already provides a managed OAuth app for Airtable (airtable), so users can connect while you work through your own app. You need your own app for your brand on the consent screen, your own rate limits, or scopes beyond the defaults. Managed auth list

If your case is different

Enterprise Scopes
Certain scopes (such as enterprise.groups:read, workspacesAndBases:write, enterprise.scim.usersAndGroups:manage, enterprise.auditLogs:read, and enterprise.changeEvents:read) are restricted only to users or admins on an Airtable enterprise account.

Steps

Agent steps an AI agent can do or draft for you. You steps that need your identity, accounts, legal authority or a real demo.

  1. Register OAuth integration

    Agent

    Navigate to /create/oauth, click 'Register new OAuth integration', supply a unique name, and provide an initial redirect URL.[1]

  2. Select permission scopes

    Agent

    Select the required permission scopes (such as data.records:read and data.records:write) on the integration management page.[1][3]

  3. Generate client secret

    Agent

    If issuing token exchange requests from a backend server, generate and securely save the client secret from the integration management page.[1]

  4. Provide distribution URLs

    Agent

    Add a support email, privacy policy URL, and terms of service URL to the integration settings to allow external users to authorize the app.[1][2]

  5. Implement PKCE authorization and token exchange

    Agent

    Implement the authorization flow with code_challenge and state parameters, exchange authorization codes at /oauth2/v1/token within 10 minutes, and handle token refreshes.[2]

What you will need

  • An Airtable account to access the developer management page at /create/oauth.[1]
  • HTTPS redirect URI (HTTPS is required for any URI beside localhost).[2]
  • Valid Privacy Policy URL, Terms of Service URL, and Support Email to enable sharing with other users outside of development.[1][2]

Nuances that catch people out

  • Users outside your development environment cannot authorize your integration until a valid Privacy Policy URL, Terms of Service URL, and Support Email are configured.[1][2]
  • Generating or regenerating a client secret is a breaking change that immediately causes existing authorization requests without the secret to fail.[1]
  • Client secrets are not recoverable once generated because Airtable does not store a copy.[1]
  • The authorization code must be exchanged for an access token within 10 minutes of the request.[2]
  • Exchanging a refresh token invalidates both the previous access token and the previous refresh token.[2]
  • API rate limits return a 429 status code requiring a 30-second back-off before subsequent requests succeed.[4]

If you get stuck or rejected

Users encounter an error or cannot authorize your integration.
Ensure that you have set a valid Privacy Policy URL, Terms of Service URL, and Support Email in the integration management page at /create/oauth.[1][2]
Token refresh requests fail with a 409 status code.
A 409 conflict indicates that the token was refreshed recently; ensure the client uses the latest refreshed token.[2]
Requests fail with a 429 status code.
Wait at least 30 seconds before retrying requests after hitting the rate limit.[4]

Evidence

What we could not verify

  • The handsOnHours range (1 to 3 hours) is an engineering estimate based on self-serve setup and PKCE implementation, as official sources do not state exact labor hours.

Sources

Each quote was checked by code against the live page. “Not found on page” means the quote may be paraphrased, so treat that claim with care.

  1. airtable.com
    Provider docsQuote found on pagechecked 2026-10-19
    Most properties are optional, but note that the Privacy policy URL and Terms of service URL must be provided before sharing your OAuth integration with other users - if you have not provided them, other users will not be able to authorize your integration.
  2. airtable.com
    Provider docsQuote found on pagechecked 2026-10-19
    Important: In order to use an integration outside of development your integration you will need to set a valid Terms of Service URL, Support Email, and Privacy Policy URL in the integration management page at /create/oauth .
  3. airtable.com
    Provider docsQuote not found on pagechecked 2026-10-19
    The following scopes are only available to users on an enterprise account:.
  4. airtable.com
    Provider docsQuote found on pagechecked 2026-10-19
    If you exceed these rates, you will receive a 429 status code and will need to wait 30 seconds before subsequent requests will succeed.