Glean is an AI-powered work assistant and enterprise search platform that connects to your company's apps and content. Integrating Glean with Frontegg lets your application search across connected content, chat and get summaries, read documents and their permissions, and manage collections, pins, and answers on behalf of your users — all through Frontegg's integration layer. Glean is self-hosted per customer, so both the API host and the OAuth endpoints are specific to your Glean instance. You can authenticate with either OAuth 2.1 (Authorization Code with PKCE) or a Glean-issued API token.
Prerequisites
Prerequisites
- A Glean instance with admin access
- Your Glean instance host — the backend host, for example
acme-be.glean.com - Admin rights in the Glean admin console (only admins can register OAuth clients or issue API tokens)
Glean runs its own OAuth authorization server, which an admin enables and where OAuth clients are registered. The client provides the Client ID and Client Secret and defines the redirect URI that Glean returns users to after they authorize access.
Sign in to Glean and open the admin console (the wrench icon in the left navigation bar).
In the admin console, go to Setup → OAuth and enable the Glean OAuth authorization server. It is disabled by default and must be turned on before clients can be registered.
Add a new OAuth client and configure it:
- Name — A descriptive name, for example
Frontegg Integration. - Redirect URI — Your Frontegg Redirect URL:
https://YOUR_MCP_GATEWAY_URL/integration-callback - Scopes — Grant the scopes your application needs (see the scopes table below).
Save the client. Glean displays the Client ID and Client Secret — copy both.
Keep your Client Secret safe
Keep your Client Secret safe
Treat the Client Secret like a password. Never expose it in client-side code or commit it to version control.
Your instance host is your Glean backend host — for example acme-be.glean.com. Use the host only, without https:// or a trailing slash.
If you are connecting a single account rather than authorizing multiple users, you can use a Glean-issued API token instead of an OAuth client:
- In the admin console, go to Setup → API Tokens and open the Client Tokens tab.
- Click Add New Token, then set a Description, Permissions, Scopes, and an Expires date, and click Save.
- Copy the token value immediately.
Copy your token now
Copy your token now
The token secret is shown only once, when it is created. Copy it and store it securely — you cannot retrieve it later. A token's permission and scopes cannot be changed after creation; issue a new token if you need different access.
The OAuth client grants the following scopes:
| Scope | Description |
|---|---|
SEARCH | Search connected content and get suggestions |
CHAT | Use the Glean Chat assistant |
DOCUMENTS | Read documents |
DOCPERMISSIONS | Read document permissions |
ENTITIES | Read people and other entities |
SUMMARIZE | Generate content summaries |
PINS | Read pins |
COLLECTIONS | Read and create collections |
ANSWERS | Read answers |
ACTIVITY | Report activity |
offline_access | Obtain a refresh token for long-lived access |
Configure the integration in the Frontegg portal using the method you chose:
- Open the Frontegg portal and navigate to [ENVIRONMENT] → Integrations → Glean.
- Enter your Glean instance host — the host only (for example,
acme-be.glean.com). - For OAuth, enter the Client ID and Client Secret. For an API token, enter the token in the API token field instead.
- Click Save.
Keep your credentials secure
Keep your credentials secure
Never share or commit your Client Secret or API token to version control.