Findings
What we learned, corrected and could not verify
We researched 10 providers chosen for different kinds of difficulty. This page is the honest summary of what that taught us, and where the evidence is thin.
What we learned
Registering is often instant. Approval attaches to what comes after.
2 of 10 providers are register-and-go (tier 1). Where there is a wait, it usually belongs to a later step: a Marketplace listing (Notion, HubSpot, Slack), a security review of a distributed package (Salesforce), or a scope review (Google, LinkedIn, Meta). A developer who only needs to connect their own account can often skip all of it, so the useful question is "which step needs the provider to say yes?", not "how long does approval take?".
Providers rarely publish how long approval takes.
No official page we read gives a duration for 3 of 10 (Shopify, LinkedIn, Meta). Where a number exists it is often a maximum (Slack's "up to" figures) or a range for one stage. Third-party blogs claim timelines; we did not use them. The guides say "not published" instead of guessing.
For most providers a developer may not need their own OAuth app to start.
Composio's own toolkit pages say "Composio-managed OAuth available" for 9 of 10 providers. Shopify says "not available", so there the developer registers first and the provider's rules apply in full. We found this by reading each toolkit's docs page, because the managed-auth directory page only fills in its toolkit list with script.
Existing setup guides cover the clicking, not the decision.
Composio lists 46 setup guides (45 apps). The ten we read give steps but no setup time, difficulty rating or troubleshooting, and several never mention approval. That is the gap these guides fill, and we cite theirs as sources rather than copying them.
What we corrected or held back
Managed-auth status was "not checked". Now sourced for all ten.
The first version said "not checked against the Composio API" for nine guides. Reading each toolkit page replaced that with a quoted statement, and turned Shopify into the one exception.
Slack times are shown as maximums.
Slack states "up to" review times. The table shows "Up to ~12 weeks" and says they are not typical times, rather than presenting a maximum as the expected wait.
HubSpot wait converted to calendar days.
HubSpot says its team finishes an initial Marketplace review within 10 business days, and the feedback process should take no more than 60 days after feedback is shared. We converted 10 business days to 14 calendar days for the numeric range and kept HubSpot's own wording visible on the guide.
Shopify's fee is not presented as fact.
The only figure we found for Shopify's registration fee came from a community reply, so it is excluded from the claims and listed as unverified.
GitHub's client-secret step is credited to its source.
GitHub's page ends at "Register application". The client-secret step comes from Composio's guide, and the guide says so.
What testing the live agent taught us
We generated guides for 23 apps outside the library and read each one against its step log and sources. This is a read-through, not a hands-on test. Faults we found, and what changed:
A marketplace listing is not a gate on your own app.
Square came out as "partner approval required" because the agent read pages about the optional App Marketplace. A high tier now needs an official page that states the gate; otherwise it is capped at Tier 2 and says so.
Forum numbers looked official.
Dropbox's 50 and 500 user limits appeared only in community posts but were tagged Sourced. A number that only a community page contains is now Reported, and forum pages are never treated as official, even on the provider's own domain.
The agent skipped the pages that answer "how long".
Spotify's quota page and Xero's certification page were in the search results but were not read. The agent now runs three fixed searches for review, access-tier and quota pages and reads the best provider matches.
"Nothing mentioned" is not a finding.
Several guides called a path self-serve with a Sourced tag because a page did not mention a review. An absence is now Unknown or Inferred, never Sourced.
Sources that did not support the claim.
Okta cited a pricing page for a free-plan claim. A Sourced claim must now share wording with its cited page, and any year it names must appear there.
Console steps given to the agent.
Steps like adding a redirect URI in the provider's console were marked "you or agent". They need your signed-in session, so they are now always yours.
What we could not verify
Every quote in the library is marked unchecked until npm run verify-quotes is run from an open-internet machine, because we read pages through a summarising tool. No hands-on registration has been logged, so nothing is tagged "tested". That log is next. The gaps below are per guide, in the guides' own words.
GitHub
- GitHub's 'creating an OAuth app' page ends at 'Register application'; the client-secret step in this guide comes from Composio's guide, not GitHub's.
- GitHub rate limits and token caps for OAuth apps were not quoted from an official page in this pass.
- GitHub Apps (a different product) are not covered step by step here.
Notion
- OPEN QUESTION to settle in the first hands-on test: Notion's authorization page has a caption saying the Authorization URL populates after a public connection is submitted for review. We could not tell whether that is a light submission or the full Marketplace review.
- Notion's portal UI has changed recently (docs point to app.notion.com/developers/connections); third-party screenshots may be stale.
- The authorization page does not name a privacy-policy requirement; the listing page lists name, description, category, tags, images and logo.
HubSpot
- HubSpot's OAuth page we read is under the 'legacy apps' path; HubSpot's newer developer platform pages may differ in click paths.
- The page does not state the access-token lifetime or refresh-token lifetime.
- Whether a public OAuth app can serve outside customers without Marketplace listing was not answered by any page read; the OAuth page only says OAuth is required for multi-account installs.
- The wait range is for Marketplace listing only; we converted 10 business days to 14 calendar days.
Salesforce
- Salesforce's help article on the connected-app to external-client-app change did not load; we could not quote whether new connected apps can still be created.
- Org edition differences (Developer vs production orgs) were not researched.
- The 1-2 / 3-4 / 2-3 week figures were read through a page summary; verify-quotes should confirm the wording.
Microsoft
- Time to verify the Microsoft AI Cloud Partner Program account is not stated.
- Admin consent flows and which Graph permissions require admin consent were not covered in this pass.
Shopify
- Shopify's distribution page does not say whether custom distribution needs review.
- No official page we read states how long App Store review takes or any registration fee; the $19 figure is from a community reply and may have changed.
- The checklist page did not mention GDPR/compliance webhooks; Shopify's separate docs on them were not read.
- Composio's Shopify guide path was followed, not tested.
Slack
- Slack's review times are stated maximums ('up to'), not typical times; real timing was not observed.
- The rate-limit page points to a changelog for the exact limits; the per-minute number was not read.
- Slack's app-creation click path was not read; follow Slack's current docs.
- How a team gets its first 10 active workspaces without being listed (unlisted distribution) is not detailed in the pages read.
- No Google page we read gives a number of days or weeks for the OAuth review; 'several weeks' is the only stated figure and it comes from the restricted-scope page.
- Cost of the third-party security assessment is not stated on the pages read.
- Which scopes are sensitive vs restricted for a given API was not enumerated.
- Brand verification timing was not found.
- No LinkedIn page we read states a typical approval duration for Development or Standard tier.
- Share on LinkedIn and Sign In with LinkedIn products (common for simple posting) were not read in this pass and may be easier than Community Management API.
- Third-party blogs claim timelines; they were not used.
Meta
- No Meta page we read states a duration for App Review or Business Verification; blogs claim numbers but were not used.
- The App Review page we read does not list required screencasts or test instructions; Meta's content and best-practice pages were not read.
- Which permissions need advanced access per use case was not enumerated.
- Business Verification requirements page failed to load in this pass.
Where this fits
How Composio and seven alternatives describe their own auth: Composio and the alternatives. The reusable patterns are on the Playbook.
Predicted versus actual for unseen apps
The plan is to predict the difficulty tier of three apps outside the library before running the live agent, then compare with the agent and the provider's own docs. That check has not been run yet. The template is in docs/TESTING.md.