## Glean integration

Glean is an AI-powered work assistant and enterprise search platform that connects to your company's apps and content. Integrating Glean with Frontegg lets your application search across connected content, chat and get summaries, read documents and their permissions, and manage collections, pins, and answers on behalf of your users — all through Frontegg's integration layer. Glean is self-hosted per customer, so both the API host and the OAuth endpoints are specific to your Glean instance. You can authenticate with either OAuth 2.1 (Authorization Code with PKCE) or a Glean-issued API token.

Prerequisites
- A [Glean](https://www.glean.com/) instance with admin access
- Your Glean **instance host** — the backend host, for example `acme-be.glean.com`
- Admin rights in the Glean admin console (only admins can register OAuth clients or issue API tokens)


### Connect Glean with OAuth

Glean runs its own OAuth authorization server, which an admin enables and where OAuth clients are registered. The client provides the **Client ID** and **Client Secret** and defines the **redirect URI** that Glean returns users to after they authorize access.

#### Step 1: Open the admin console

Sign in to Glean and open the **admin console** (the wrench icon in the left navigation bar).

#### Step 2: Enable the OAuth authorization server

In the admin console, go to **Setup → OAuth** and enable the Glean OAuth authorization server. It is disabled by default and must be turned on before clients can be registered.

#### Step 3: Register an OAuth client

Add a new OAuth client and configure it:

- **Name** — A descriptive name, for example `Frontegg Integration`.
- **Redirect URI** — Your Frontegg Redirect URL: `https://YOUR_MCP_GATEWAY_URL/integration-callback`
- **Scopes** — Grant the scopes your application needs (see the scopes table below).


Save the client. Glean displays the **Client ID** and **Client Secret** — copy both.

Keep your Client Secret safe
Treat the Client Secret like a password. Never expose it in client-side code or commit it to version control.

#### Step 4: Note your instance host

Your **instance host** is your Glean backend host — for example `acme-be.glean.com`. Use the host only, without `https://` or a trailing slash.

### Use an API token instead

If you are connecting a single account rather than authorizing multiple users, you can use a Glean-issued API token instead of an OAuth client:

- In the admin console, go to **Setup → API Tokens** and open the **Client Tokens** tab.
- Click **Add New Token**, then set a **Description**, **Permissions**, **Scopes**, and an **Expires** date, and click **Save**.
- Copy the token value immediately.


Copy your token now
The token secret is shown only once, when it is created. Copy it and store it securely — you cannot retrieve it later. A token's permission and scopes cannot be changed after creation; issue a new token if you need different access.

### Scopes

The OAuth client grants the following scopes:

| Scope | Description |
|  --- | --- |
| `SEARCH` | Search connected content and get suggestions |
| `CHAT` | Use the Glean Chat assistant |
| `DOCUMENTS` | Read documents |
| `DOCPERMISSIONS` | Read document permissions |
| `ENTITIES` | Read people and other entities |
| `SUMMARIZE` | Generate content summaries |
| `PINS` | Read pins |
| `COLLECTIONS` | Read and create collections |
| `ANSWERS` | Read answers |
| `ACTIVITY` | Report activity |
| `offline_access` | Obtain a refresh token for long-lived access |


### Configure the Frontegg portal

Configure the integration in the Frontegg portal using the method you chose:

1. Open the **Frontegg portal** and navigate to [ENVIRONMENT] → Integrations → Glean.
2. Enter your **Glean instance host** — the host only (for example, `acme-be.glean.com`).
3. For **OAuth**, enter the **Client ID** and **Client Secret**. For an **API token**, enter the token in the **API token** field instead.
4. Click **Save**.


Keep your credentials secure
Never share or commit your Client Secret or API token to version control.

### Additional resources

- [Glean OAuth authentication](https://developers.glean.com/api-info/client/authentication/oauth)
- [Glean-issued API tokens](https://developers.glean.com/api-info/client/authentication/glean-issued)
- [How to get your Redirect URL](/agen-for-work/connectors/redirect-url)