Create a new connected account

Initiates a new connection to an external service for a user. For OAuth-based toolkits, this returns a redirect URL to complete authentication. For API key-based toolkits, provide the credentials directly in the request body. Use the user_id field to associate the connection with a specific user in your system.

Deprecated for Composio-managed OAuth: For Composio-managed auth configs on OAuth1, OAuth2, or DCR_OAUTH schemes, this endpoint is being retired and will start returning 400 BadRequest on 2026-05-08 for new organizations and 2026-07-03 for all remaining organizations. Migrate those calls to POST /api/v3/connected_accounts/link. Custom auth configs and non-OAuth schemes (API key, bearer, basic) continue to be supported here. Responses on the retiring path carry a Deprecation header (RFC 9745) and a Sunset header (RFC 8594) for client-side detection.

Credential check: where the toolkit supports it, submitted API key, basic, and bearer credentials are checked against the provider before the connection is stored — no opt-in required. For toolkits with the check enabled, credentials the provider rejects fail the request with ConnectedAccount_CredentialValidationRejected. If the provider is unreachable, times out, or returns an error of its own, the connection is created as normal.