Twenty Oauth Mastery

What This Skill Does

The Twenty Oauth Mastery skill, authored by avirweb, is an expert-level diagnostic and implementation toolkit specifically engineered for the Twenty CRM ecosystem. It provides the OpenClaw AI agent with deep knowledge of the Twenty-server architecture, Passport.js integration patterns, and the nuanced OAuth 2.0 flow requirements for Google and Microsoft providers. This skill acts as a bridge between high-level architectural understanding and low-level code implementation, enabling the agent to assist developers with complex token refresh cycles, redirect loop troubleshooting, and precise scope management within the NestJS framework.

Installation

To integrate this skill into your OpenClaw agent, execute the following command in your terminal: clawhub install openclaw/skills/skills/avirweb/twenty-oauth-mastery

Ensure your development environment is connected to the OpenClaw SDK and that your environment variables are configured to allow access to the target Twenty CRM codebase.

Use Cases

• Debugging Authentication Flows: The agent can analyze auth.service.ts and google.auth.strategy.ts to identify why callback URLs are failing.
• Implementing New Providers: Guiding the addition of OAuth providers by ensuring correct scope definitions and strategy registration.
• Domain & Security Policies: Configuring allowlists for specific organizational domains during the OAuth handshake process.
• Sync Integration: Automating the resolution of Google/Microsoft calendar and email sync initialization issues by validating token storage in the strategy logic.

Example Prompts

1. "I'm getting a redirect loop during the Google OAuth flow in my Twenty CRM setup. Can you help me trace the flow in auth.service.ts and identify the configuration issue?"
2. "How should I modify the google-auth.controller.ts to enforce a strict domain restriction for our corporate @company.com email addresses?"
3. "My Gmail sync integration is failing. Walk me through the required changes in google.auth.strategy.ts to ensure the validate() method returns the correct token objects."

Tips & Limitations

• Version Control: This skill is optimized for Twenty CRM versions corresponding to the 2026-02-08 baseline; ensure your project aligns with these architectural patterns.
• Security: Always verify your environment variables (AUTH_GOOGLE_CLIENT_SECRET, etc.) are securely handled via environment secrets and never hardcoded.
• Debugging: When troubleshooting, the agent is trained to look for passReqToCallback: true in strategy configurations; if your implementation misses this, the agent will flag it as a priority error.
• Scope creep: Be mindful of OAuth scope expansion; adding unnecessary scopes can lead to user friction during the consent screen process.