Provision user-scoped API access via Alter
The application backend securely calls third-party APIs on behalf of authenticated users without storing tokens or tracking grant IDs, leveraging Alter's Connect flow and JWT-based identity resolution.
How it works
The agent configures an Alter app with the necessary scopes (connect:initiate, grants:write, tokens:retrieve, proxy:execute). It sets up an identity provider (e.g., Auth0, Clerk) to authenticate end users. When a user initiates a connection (e.g., to Google), the backend mints a short-lived Connect session bound to the user's JWT. The frontend opens the Connect widget to complete OAuth consent. Finally, the backend uses the Alter SDK to call the provider API, passing the user's JWT so Alter resolves the grant, refreshes the token, and executes the request on the user's behalf.
Prompt
Paste this into an agent that has the servers below connected. Adjust the names and dates to your own.
Configure an Alter app to allow calling Google APIs on behalf of authenticated users. The app must use an identity provider (like Clerk) to verify user JWTs. Implement a backend endpoint that mints a Connect session for the 'google' provider bound to the user's JWT. Ensure the backend can subsequently call the Google API using the user's JWT to resolve the grant automatically without storing tokens.MCP servers it needs
Source
The vendor page this playbook is drawn from, and the passage that supports it.
By the end of this guide, an application backend calls third-party APIs on behalf of any logged-in user, without storing tokens and without tracking grant_id in the application database.Call APIs on Behalf of Users | Alter