Nango POC — identity-bound API access
The app holds only your Okta token — never a Nango secret key, never a connection id. The gateway derives your identity from the token and does the rest.
Okta token
→
Gateway
verify · derive sub
verify · derive sub
→
Nango
your connection
your connection
→
Google Drive
Step 0 · Your identity
Paste an Okta access token (the $HATCH_JWT). The gateway verifies it
and everything downstream acts as the identity inside it.
No token yet.
Step 1 · Connect (consent)
Mints a scoped session via the gateway (/exchange) bound to your
identity, then runs Google consent. The app never sees a secret key.
Verify identity first.
Step 2 · Fetch data (as you)
Calls the gateway proxy GET /proxy/drive/v3/about?fields=user,storageQuota with only your
Okta token. The gateway looks up your connection and injects the credential.