Attio

1. In your zone’s Keycard Console, go to Resources -> Explore Resources.

2. Search for Attio and click into the catalog entry.

3. The install dialog shows a Redirect URI. Copy it - you’ll paste it into Attio in Step 2. Leave this Keycard tab open.

1. Go to Attio Build
2. Click New app
3. Enter a Name for your app (e.g., “Keycard”) and click Create app

1. Go to the OAuth tab
2. Toggle OAuth on to enable it
3. Copy the Client ID and Client Secret
4. Under Redirect URIs, click New redirect URI and add the redirect URI provided by Keycard
5. Under Scopes, click Configure scopes and add the scopes your app needs

1. Switch back to the Keycard install dialog you left open in Step 1.

2. Paste the Client ID and Client Secret from Step 2.

3. Click Add Attio. The resource is provisioned and your app can start exchanging tokens for it.

After installing Attio, your application exchanges a Keycard-issued access token for a token scoped to this resource. Pass the user’s access token as the subject_token.

from keycardai.oauth import Client, BasicAuth, TokenType
import requests

# Exchange the user's Keycard token for a Attio token.
with Client(
    "https://<zone-id>.keycard.cloud",
    auth=BasicAuth("<your-client-id>", "<your-client-secret>"),
) as client:
    response = client.exchange_token(
        subject_token=user_access_token,
        subject_token_type=TokenType.ACCESS_TOKEN,
        resource="https://api.attio.com",
    )

# Call Attio directly with the exchanged token.
r = requests.get(
    "https://api.attio.com/<endpoint>",
    headers={"Authorization": f"Bearer {response.access_token}"},
)

import { TokenExchangeClient } from "@keycardai/oauth/tokenExchange";

const client = new TokenExchangeClient("https://<zone-id>.keycard.cloud", {
  clientId: "<your-client-id>",
  clientSecret: "<your-client-secret>",
});

const response = await client.exchangeToken({
  subjectToken: userAccessToken,
  resource: "https://api.attio.com",
});

// Call Attio directly with the exchanged token.
const res = await fetch("https://api.attio.com/<endpoint>", {
  headers: { Authorization: `Bearer ${response.accessToken}` },
});

See the OAuth SDK → Token Exchange reference for the full client API.

Now do this

• Call Attio from your code - see the Use Attio from your code section above for Python and TypeScript samples.

Recommended

• Decide who can use it - write access policies scoped to the Attio resource so only the right users and apps reach the API.
• Watch the calls - every token exchange and downstream call lands in your audit log with user identity, resource, and policy decision.

Optional

• Add MCP access too - install the Attio MCP server for AI agents that need Attio’s tools, not just the REST API.