# Set up Chase Deadlines

This is a read-only composite, but it needs a model credential and every listed data source configured before it can run. Set up isolated test accounts or workspaces first, grant only the smallest read scope that exposes the test data, and store every credential only in Dome's secret inputs. Never put a key or secret in this repository, an agent prompt, or a chat message.

## Create the model credential

- Create an API key in the [Anthropic Console](https://console.anthropic.com/settings/keys).
- Enter the raw key as `anthropic_api_key` during import. Do not prepend `Bearer `.
- The template uses that key only for its managed `claude-sonnet-5` model connection.

## Create the provider credentials

- `asana_oauth_client_id`: Client ID for a pre-registered Asana MCP app.
- `asana_oauth_client_secret`: Client secret for a pre-registered Asana MCP app.
- `google_oauth_client_id`: A Google OAuth client ID for an AI-powered agent.
- `google_oauth_client_secret`: The Google OAuth client secret.
- `slack_oauth_client_id`: A Slack app client ID.
- `slack_oauth_client_secret`: The Slack app client secret.

For a provider that asks you to register a manual OAuth app, use this callback URL exactly:

`https://api.domesystems.ai/oauth/callback`

## Set up each connected provider

### Asana

Asana's V2 MCP server requires a pre-registered **MCP app**; it does not
support Dynamic Client Registration.

- In the [Asana developer console](https://app.asana.com/0/developer-console),
  create an **MCP app**.
- In **OAuth**, register the exact redirect URI
  `https://api.domesystems.ai/oauth/callback`.
- In **Manage distribution**, allow the Asana workspace that will be used for
  this agent.
- `asana_oauth_client_id`: enter the MCP app's Client ID.
- `asana_oauth_client_secret`: enter the MCP app's Client secret.

After saving, sign in through OAuth with a test user that can see only the
projects and tasks this agent should read. Asana MCP apps use the permissions of
the authorizing user; do not request a separate OAuth scope.

### Linear

This provider uses Dynamic Client Registration (DCR). Do **not** create or paste an OAuth client ID or client secret: after import, Dome registers the client and opens the provider's consent page.

Linear's read-only endpoint supports OAuth 2.1 with Dynamic Client
Registration. This composite uses `https://mcp.linear.app/mcp/readonly`, so it
does not require a manually created Linear application or API key.

- After import, complete shared OAuth as a dedicated test member, select the
  intended workspace, and verify a known test issue is visible while an
  unshared team's issue is unavailable.

The upstream endpoint and the requested `read` scope are read-only. A separate
API-key or existing-OAuth-token configuration is available for a non-interactive
integration; do not add a personal full-access key to this composite.

### Gmail

Before import, open [Google Cloud OAuth clients](https://console.cloud.google.com/auth/clients/create) and create a **Web application** OAuth client. Enable **Use this client for an AI-powered agent**, add `https://api.domesystems.ai/oauth/callback` as an authorized redirect URI, and copy the client ID and secret. In **APIs & Services → Library**, enable both **Gmail API** and **Gmail MCP API** for that same project. Configure the consent screen as **Internal**, or add the test user if it is **External**.

- `google_oauth_client_id` and `google_oauth_client_secret`: enter values from a Google Cloud Web OAuth client configured as an AI-powered agent.

Enable the Gmail and Gmail MCP APIs, add only `gmail.readonly`, and register the redirect URI shown by Dome. Use a test mailbox for the first connection.

### Slack

Before import, create a Slack app at [api.slack.com/apps](https://api.slack.com/apps). Choose **From scratch**, make it internal to the intended workspace, then copy the client ID and client secret from **Basic Information**. In **OAuth & Permissions**, add `https://api.domesystems.ai/oauth/callback` as a redirect URL. In **Agents**, enable **Slack Model Context Protocol (MCP) Server**. Add only the read/search/history/channel/user scopes requested by this template; do not add any write scope. Install or reinstall the app to the dedicated test workspace after changing scopes.

- `slack_oauth_client_id` and `slack_oauth_client_secret`: enter values from an approved internal Slack app.

In the Slack app's **Agents** section, enable the **Slack Model Context Protocol (MCP) Server** feature. Register Dome's redirect URI and grant only the template's search, history, channel, user, canvas-read, and list-read scopes. Do not add `chat:write`, file-write, canvas-write, or other write scopes.

### Google Calendar

Before import, open [Google Cloud OAuth clients](https://console.cloud.google.com/auth/clients/create) and create a **Web application** OAuth client. Enable **Use this client for an AI-powered agent**, add `https://api.domesystems.ai/oauth/callback` as an authorized redirect URI, and copy the client ID and secret. In **APIs & Services → Library**, enable both **Google Calendar API** and **Google Calendar MCP API** for that same project. Configure the consent screen as **Internal**, or add the test user if it is **External**.

- `google_oauth_client_id` and `google_oauth_client_secret`: enter values from a Google Cloud Web OAuth client configured as an AI-powered agent.

Enable the Calendar and Calendar MCP APIs, register the redirect URI shown by Dome, and retain only the calendar list, free/busy, and event read scopes.

## Import and verify

1. Import the template and provide the values above.
2. Complete every browser OAuth flow with the intended dedicated test user. Token-based sources do not open a browser.
3. Open **Tools**, refresh discovery, and confirm every connection is attached to the template gateway.
4. Run the managed agent against known test data. Treat the template as verified only when the run succeeds **and calls at least one expected read-only tool**.

If a connection is unreachable, check the provider section above for its callback, API/MCP enablement, token prefix, consent scopes, and user/workspace access before retrying.