This feature only applies to Embedded iPaaS
Who this guide is for
- Developers integrating a third‑party API that Alloy doesn’t yet support.
- Teams wrapping internal services as a connector so agents and flows can call them safely.
- Partners turning their public API into a first‑class Alloy integration.
Before you begin
- Have an API to wrap. Confirm base URL(s), auth scheme, request/response formats, rate limits, and error model.
- Get credentials. Create sandbox/test accounts and API keys or OAuth client credentials.
- Decide scope. List the initial Actions (e.g., Create Ticket, Search Contacts) and Triggers (e.g., New Order Created). Start small; ship value fast.
Authentication
Custom Connector supports:- OAuth 2.0
- API Key
- Basic
- Bearer/Custom
- None
Set Up Guide
Trial Access
Question | Answer |
---|---|
Offers free trial? | Yes. Acuity Scheduling offers a free 7-day trial. Sign up at https://acuityscheduling.com. |
Requires requires paid sandbox | No paid sandbox required. You can test with your trial account. |
Requires partnership to obtain authentication? | No. You can obtain API credentials directly from your Acuity Scheduling account settings. |
Authentication (HTTP Basic Authentication)
Acuity Scheduling uses HTTP Basic Authentication with your User ID and API Key.Create your Acuity Scheduling account
- Sign up for a free trial at Acuity Scheduling (https://acuityscheduling.com).
- Once logged in, navigate to Business Settings → Integrations → API.
- Your User ID is displayed at the top of the API page (a numeric value).
- Click Show API Key to reveal your API Key, or generate a new one if needed.
- Copy your User ID and API Key.
- Enter your User ID as the username and API Key as the password into Alloy Automation.
OAuth 2.0
Use when the service supports OAuth. It gives per‑user or per‑tenant installs and easy revocation. Required fieldsauthorization_url
token_url
client_id
andclient_secret
scopes
(only what you need)redirect_uri
(use Alloy Automation’s redirect URI)
Token handling
Refresh tokens proactively (e.g., when expires_in < 5m), storetoken_type
and use exactly as returned (Bearer, case‑sensitive).
Common pitfalls
Mismatched redirect_uri or missing code_verifier (for PKCE flows).API Key
Use for server‑to‑server or legacy APIs. Support header and query placements (e.g., Authorization: Api-Key, ?api_key=). Allow customer‑specific header names if the provider is non‑standard. Never log secrets; mask in UI and logs.Custom/Bearer
Some APIs use static bearer tokens or HMAC signatures. Expose configurable fields (e.g., tenant_id, region) and compute the signature per request.API definitions (Base URL & test)
After saving credentials, set a Base URL for the provider (e.g., https://api.spotify.com/v1). This reduces boilerplate in actions and centralizes environment changes. Use the built‑in Test request tool to validate your configuration before building actions.Creating a Custom Connector
To start, click “Create a Custom Connector”.


