Connect to OpenAPI

Learn how to connect OpenAPI to Retool.

Version: Cloud and 3.178 Edge

Retool supports OpenAPI versions 3.0.x. OpenAPI versions 3.1.x are not currently supported.

You can use the OpenAPI integration to create a resource and make it available in Retool. Once complete, your users can write queries that interact with OpenAPI data.

Requirements

The OpenAPI integration requirements depend on whether you have a cloud-hosted or self-hosted Retool organization. You may also need to make OpenAPI configuration changes before creating the resource.

Cloud-hosted organizations

Sufficient user permissions to create resources

All users for Retool organizations on Free or Team plans have global Edit permissions and can add, edit, and remove resources. If your organization manages user permissions for resources, you must be a member of a group with Edit all permissions.

Allow Retool to access the data source

If the data source is behind a firewall or restricts access based on IP address, then you must ensure that your Retool organization can access it. If necessary, configure your data source to allow access from Retool's IP addresses.

CIDR IP addresses

3.77.79.248/30
35.90.103.132/30
44.208.168.68/30

Individual IP addresses

3.77.79.249
3.77.79.250
35.90.103.132
35.90.103.133
35.90.103.134
35.90.103.135
44.208.168.68
44.208.168.69
44.208.168.70
44.208.168.71

Retool is building support for querying firewalled resources without allowlisting Retool’s IP address. To learn more or be considered for early access, contact cloud-connect@retool.com.

OpenAPI settings and authentication

You must have sufficient access and familiarity with your OpenAPI data source so you can provide:

• Required connection settings (e.g., URL and server variables).
• Authentication credentials (e.g., API keys).

In some cases, you may need to make changes to your OpenAPI configuration, such as generating authentication credentials or allowing access through a firewall. Refer to the configuration and authentication sections to learn more.

Self-hosted organizations

Sufficient user permissions to create resources

All users for Retool organizations on Free or Team plans have global Edit permissions and can add, edit, and remove resources. If your organization manages user permissions for resources, you must be a member of a group with Edit all permissions.

Allow your deployment to access the data source

Your self-hosted deployment must have access to the data source. Ensure that any potential firewall rules for either the data source or your deployment instance are updated to allow them to communicate.

OpenAPI settings and authentication

You must have sufficient access and familiarity with your OpenAPI data source so you can provide:

• Required connection settings (e.g., URL and server variables).
• Authentication credentials (e.g., API keys).

In some cases, you may need to make changes to your OpenAPI configuration, such as generating authentication credentials or allowing access through a firewall. Refer to the configuration and authentication sections to learn more.

Configure the resource

Sign in to your Retool organization and navigate to the Resources tab. Click Create new > Resource, then select OpenAPI.

Configuration

Specify the name, location, and description to use for your OpenAPI resource. Retool displays the resource name and type in query editors to help users identify them.

Provide the following configuration settings to create the resource. Depending on how your data source is configured, you may also need to provide optional settings for Retool to connect.

Cloud-hosted organizations

Name

The name to use for the resource.

Description

A description of the resource.

Specification URL

The URL for the OpenAPI specification to use.

Forward headers when fetching OpenAPI spec

Whether to forward headers when fetching the OpenAPI spec.

URL parameters

Additional URL parameters to include with all requests.

Headers

Additional headers to include with all requests.

Cookies

Cookies to use for cookie-based APIs.

Use the pattern COOKIE_your_cookie_name in the Headers section to implement the double-cookie submit pattern.

Forward all cookies

Whether to forward all cookies.

Override default outbound Retool region

Retool connects to your data source from the us-west-2 region. Choosing a different outbound region can improve performance through geographic proximity.

Region	Location
us-west-2	US West (Oregon)
eu-central-1	Europe (Frankfurt, Germany)
ap-southeast-1	Asia-Pacific (Singapore)

Self-hosted organizations

Name

The name to use for the resource.

Description

A description of the resource.

Specification URL

The URL for the OpenAPI specification to use.

Forward headers when fetching OpenAPI spec

Whether to forward headers when fetching the OpenAPI spec.

URL parameters

Additional URL parameters to include with all requests.

Headers

Additional headers to include with all requests.

Cookies

Cookies to use for cookie-based APIs.

Use the pattern COOKIE_your_cookie_name in the Headers section to implement the double-cookie submit pattern.

Forward all cookies

Whether to forward all cookies.

Authentication

The OpenAPI integration supports the following authentication methods. Depending on which authentication method you use, you may need to make changes to your OpenAPI configuration.

Cloud-hosted organizations

Basic

Authentication is performed using Basic HTTP authentication with a username and password. You must be able to obtain and provide these credentials to create the resource.

Bearer Token

Authentication is performed using Bearer HTTP authentication with a token. You must be able to obtain and provide these credentials to create the resource.

Custom OAuth 2.0 client credentials

Authentication is performed using a custom OAuth 2.0 client app. You must create this client and then provide its credentials. Once configured, your users are redirected to to sign in and authorize Retool to access data.

OAuth apps typically require the following values during creation:

• OAuth callback URL: The URL to which users are redirected once they have successfully signed in.
• Scopes : The permissions granted to Retool. Each scope defines a specific set of permissions (e.g., messages:read to read messages users:write to create new users). You must ensure that any scopes defined in your OAuth app matches the scopes you specify when configuring the resource.

Once you've created an OAuth app you can obtain its credentials, such as the Client ID and Client secret. You then provide these to configure Retool for OAuth authentication.

Refer to the documentation for detailed instructions on creating an OAuth app.

Authorization URL

The URL with which to authenticate.

Access token URL

The access token URL.

Client ID

The client ID with which to authenticate.

Client secret

The client secret with which to authenticate.

Scopes

Scopes govern what permissions Retool has once you connect your account authenticates. For some integrations, Retool automatically populates a set of recommended scopes to make full use of the integration. In some cases, you may need to specify the scopes for Retool to use.

Prompt

The type of prompt when users authenticate.

Value	Description
None	Attempt to authorize silently without using a prompt.
Consent	Prompt the user to consent.
Login	Require the user to sign in with the provider, regardless of whether they are currently signed in.
Select account	Require the user to select an account if they could be signed into multiple accounts.
No prompt	Do not display a prompt.

Audience

The OAuth 2.0 audience.

Enable an auth verification endpoint

Whether to use a custom authentication verification URL.

If enabled, you can provide an endpoint that will return a response code in the range 200-299 when the user is authenticated, and a non-2xx status code (e.g., 401 Unauthorized) when the user is not authenticated.

Skip Retool consent screen and attempt login

Whether to skip the Retool consent screen at the start of the authentication flow.

Access token lifespan

The lifespan of the access token before it expires.

Custom

You can define a custom authentication flow with which Retool uses to authenticate. This can contain multiple steps and is best suited for complex authentication flows.

Self-hosted organizations

Basic

Authentication is performed using Basic HTTP authentication with a username and password. You must be able to obtain and provide these credentials to create the resource.

Bearer Token

Authentication is performed using Bearer HTTP authentication with a token. You must be able to obtain and provide these credentials to create the resource.

Custom OAuth 2.0 client credentials

Authentication is performed using a custom OAuth 2.0 client app. You must create this client and then provide its credentials. Once configured, your users are redirected to to sign in and authorize Retool to access data.

OAuth apps typically require the following values during creation:

• OAuth callback URL: The URL to which users are redirected once they have successfully signed in.
• Scopes : The permissions granted to Retool. Each scope defines a specific set of permissions (e.g., messages:read to read messages users:write to create new users). You must ensure that any scopes defined in your OAuth app matches the scopes you specify when configuring the resource.

Once you've created an OAuth app you can obtain its credentials, such as the Client ID and Client secret. You then provide these to configure Retool for OAuth authentication.

Refer to the documentation for detailed instructions on creating an OAuth app.

Authorization URL

The URL with which to authenticate.

Access token URL

The access token URL.

Client ID

The client ID with which to authenticate.

Client secret

The client secret with which to authenticate.

Scopes

Scopes govern what permissions Retool has once you connect your account authenticates. For some integrations, Retool automatically populates a set of recommended scopes to make full use of the integration. In some cases, you may need to specify the scopes for Retool to use.

Prompt

The type of prompt when users authenticate.

Value	Description
None	Attempt to authorize silently without using a prompt.
Consent	Prompt the user to consent.
Login	Require the user to sign in with the provider, regardless of whether they are currently signed in.
Select account	Require the user to select an account if they could be signed into multiple accounts.
No prompt	Do not display a prompt.

Audience

The OAuth 2.0 audience.

Enable an auth verification endpoint

Whether to use a custom authentication verification URL.

If enabled, you can provide an endpoint that will return a response code in the range 200-299 when the user is authenticated, and a non-2xx status code (e.g., 401 Unauthorized) when the user is not authenticated.

Skip Retool consent screen and attempt login

Whether to skip the Retool consent screen at the start of the authentication flow.

Access token lifespan

The lifespan of the access token before it expires.

Custom

You can define a custom authentication flow with which Retool uses to authenticate. This can contain multiple steps and is best suited for complex authentication flows.

Test the connection

Click Test Connection to verify that Retool can successfully connect to the data source. If the test fails, check the resource settings and try again.

Testing a connection only checks whether Retool can successfully connect to the resource. It cannot check whether the provided credentials have sufficient privileges or can perform every supported action.

Save the resource

Click Create resource to complete the setup. You can then click either Create app to immediately start building a Retool app or Back to resources to return to the list of resources.

Next steps

Your OpenAPI resource is now ready to use. Check out related queries and code documentation to learn how to interact with OpenAPI data.

Queries and code quickstart

Fundamental concepts of queries and code.

Resource query tutorial

Hands-on introduction to querying APIs and databases.