Connect your own app (BYO)

Use your own Microsoft or Google app instead of the shared app, so the OAuth consent stays within your own tenant.

By default, HeyOtto connects via the shared platform app. Each company can instead their own app use: your own IT registers the app in your tenant, your admin approves the permissions (admin consent), and the OAuth consent stays entirely within your own Microsoft/Google environment — never that of another company. Enter the details under Settings → Own mailbox app (only the Owner sees this). Secrets are encrypted saved.

Microsoft 365 (Entra ID)

  1. Go to Microsoft Entra ID → App-registraties → Nieuwe registratie.
  2. Accounttype: Single tenant (only your company) is the most restricted. Choose multitenant only if multiple tenants deliberately use the same app.
  3. Redirect-URI (type Web): paste the exact URI shown on the HeyOtto page, e.g. https://app.heyotto.eu/auth/microsoft/callback (note: https).
  4. Under API-machtigingen → Microsoft Graph → Gedelegeerd you add: Mail.ReadWrite, Mail.ReadWrite.Shared, MailboxSettings.ReadWrite, Tasks.ReadWrite, User.Read, offline_access. Then click Beheerderstoestemming verlenen — this is the moment your IT team approves the app. (Deliberately no Mail.Send: HeyOtto never sends from your mailbox.)
  5. Under Certificaten & geheimen you create a client secret and copy the Value.
  6. Enter in HeyOtto: Application (client) ID, Directory (tenant) ID and the client secret. Save.
After that, "Connect Microsoft 365" automatically uses your own app — consent stays within your tenant, with only the permissions your IT has approved.

Google Workspace

  1. In the Google Cloud Console, create a OAuth-client (Web application).
  2. Add the geautoriseerde redirect-URI that is on the HeyOtto page, e.g. https://app.heyotto.eu/auth/google/callback.
  3. Grant the Gmail scope (gmail.modify) and set the correct test users or publish the consent screen.
  4. Enter Client ID and Client secret in to HeyOtto. Save.

Fallback

If you leave the fields empty, HeyOtto uses the shared platform app. You can switch to your own app at any time by filling in the details.

Next: Login SSO (OIDC) →