The application backend securely calls third-party APIs on behalf of authenticated users without storing tokens or tracking grant IDs, leveraging Alter's Connect flow and JWT-based identity resolution.
The agent configures an Alter app with the necessary scopes (connect:initiate, grants:write, tokens:retrieve, proxy:execute). It sets up an identity provider (e.g., Auth0, Clerk) to authenticate end users. When a user initiates a connection (e.g., to Google), the backend mints a short-lived Connect session bound to the user's JWT. The frontend opens the Connect widget to complete OAuth consent. Finally, the backend uses the Alter SDK to call the provider API, passing the user's JWT so Alter resolves the grant, refreshes the token, and executes the request on the user's behalf.
- Category: Software development
- Effect: Changes data in your accounts
- MCP servers: Alter Docs MCP (https://koskamo.com/explore/alter-docs-mcp)
- Source: Call APIs on Behalf of Users | Alter (https://docs.alterauth.com/guides/call-apis-on-behalf-of-users/)
- Source quote: "By the end of this guide, an application backend calls third-party APIs on behalf of any logged-in user, without storing tokens and without tracking grant_id in the application database."
- Playbook page: https://koskamo.com/explore/use-cases/provision-user-scoped-api-access-via-alter
Prompt: Configure an Alter app to allow calling Google APIs on behalf of authenticated users. The app must use an identity provider (like Clerk) to verify user JWTs. Implement a backend endpoint that mints a Connect session for the 'google' provider bound to the user's JWT. Ensure the backend can subsequently call the Google API using the user's JWT to resolve the grant automatically without storing tokens.