# Integrate with Asana
Source: https://docs.inflection.io/agents/asana
Tag an Asana task and the Inflection agent reads the brief, builds an Inflection email, and posts the result back to the task.
The Inflection agent in **Asana** meets content ops where briefs already live. **Tag a task** and the agent reads the brief, builds an Inflection email, and posts the result back to the task — no copy-pasting between your project tracker and the platform. It's a focused, workflow-triggered surface centered on email creation.
## Why use Asana
**Briefs become assets automatically.** The task you were going to write up anyway becomes a drafted email.
**Content ops stays in one place.** Writers and PMs work in Asana; the email shows up on the task.
**Trigger-based, hands-off.** No new tool to learn — a tag, assignment, or section change kicks off the build.
## What you can do here
### Build an email from a tagged task
The agent reads the task's brief and generates an Inflection email asset, posting a link/preview back as a task comment for review.
**Why it matters:** the brief-to-email handoff that used to be manual now happens the moment a task is ready.
**How it runs**
* Write the email brief in the Asana task description.
* Trigger the agent: assign the task, add a tag (e.g. "AI: build email"), or move the task to a new section.
* The agent replies on the task with the generated email.
### Build from a design (tenant skill)
Where enabled, a companion skill builds an Inflection email from a **Figma** design (`inflection-email-from-figma`) — useful when design hands off comps rather than copy.
**Availability:** the Asana → email flow is delivered as a connected-agent / skill and may be enabled per tenant — check with your CS team.
## Step 1 — Create a Personal Access Token in Asana
Please note that the actions done by Inflection Agent in Asana (comment in the ticket) will reflect as coming from the user account that made the PAT. It is advisable to create a new user in Asana (like "Inflection Bot") and use that account to create the PAT. This way all actions on tickets will be made by "Inflection Bot".
[Watch the Personal Access Token walkthrough on Loom](https://www.loom.com/share/4c1441067b2043a39ee0a135f416f703)
1. Navigate to [https://app.asana.com/0/my-apps](https://app.asana.com/0/my-apps)
2. Create a new Personal Access Token
3. Give it a relevant name
4. Copy the token — keep it safe, you won't be able to see it again
## Step 2 — Connect Asana in Inflection
[Watch the connection walkthrough on Loom](https://www.loom.com/share/3263c280b40940dd88a5ec86af50fd10)
1. Go to the Connections tab: [https://app.inflection.io/connections](https://app.inflection.io/connections)
2. Click **+ Add new connection**
3. Select **Asana** → enter a name for the connection → paste the PAT you copied from Asana
4. In the AI Agent triggers, add your Asana project ID where the Campaign Ops Agent will work on tasks
Your project ID is the string of numbers in your project's URL — it looks like `https://app.asana.com/0/projectID/list`
5. Set the trigger condition — choose when you want the agent to pick up tasks:
1. When the task is assigned to someone
2. When a tag is added
3. When a section is changed
You're good to go! Whenever a trigger condition is met, the agent picks up the task, builds emails, and comments back on the Asana ticket.
## Use cases & inspiration
**Editorial calendar → emails.** Each content task, once briefed and tagged (or assigned), comes back with a drafted email ready for review.
**Design-led campaigns.** Hand off a Figma comp and get a matching Inflection email to refine.
## Good to know (limitations)
**Email-focused.** The Asana surface centers on building emails from a brief — audiences, segments, and journeys live in the in-app chat / MCP.
**Tenant-scoped today.** Delivered as a connected agent / skill; availability and exact trigger behavior vary by tenant.
**Drafts for review.** The generated email is a starting point you refine and approve before sending.
## Prompting best practices
**Write the brief like you mean it.** Audience, goal, key message, and CTA in the task description produce a better first draft.
**One task, one email.** Keep each task scoped to a single email for a clean result.
## Report unexpected outcomes
Share issues in your Inflection Slack channel with the task link, your goal, and screenshots of the brief and the generated output.
## Share your use cases
Tell us how Asana fits your content workflow — what triggers and outputs would help most.
# Inflection Connected Apps using oAuth 2.1
Source: https://docs.inflection.io/agents/connected-apps-oauth
Connect to Inflection's MCP server.
This guide explains how to set up OAuth 2.1 authentication for general-purpose MCP access to the Inflection platform.
## About This Guide
### Scope of This Documentation
This guide covers **general-purpose OAuth 2.1 authentication** for:
* Custom integrations and applications
* Third-party automation tools (n8n, Zapier, Make, etc.)
* API testing tools (Postman, Insomnia, etc.)
* Custom scripts and internal tooling
* Calling the [Inflection Developer API](/api-reference/introduction)
### MCP Authentication (Claude, ChatGPT, etc.)
If you're looking to connect Inflection with **AI assistants via MCP (Model Context Protocol)**, such as:
* Claude (Anthropic)
* ChatGPT (OpenAI)
Please refer to the specific **MCP Integration Guide** for ChatGPT and Claude
## Overview
Inflection uses **OAuth 2.1 with PKCE** (Proof Key for Code Exchange) for secure API authentication. This modern authentication standard provides enhanced security for both web and native applications.
### Key Features
| Feature | Description |
| - | - |
| OAuth 2.1 | Latest OAuth standard with security best practices |
| PKCE Required | Protects against authorization code interception attacks |
| Refresh Tokens | Automatically renew access without re-authentication |
| Secure Access | Token-based authentication for all API calls |
### When to Use This Authentication Method
| Use Case | Authentication Method |
| - | - |
| Custom app integrations | ✅ OAuth 2.1 (this guide) |
| Automation platforms (n8n, Zapier) | ✅ OAuth 2.1 (this guide) |
| API testing (Postman) | ✅ OAuth 2.1 (this guide) |
| Internal scripts and tools | ✅ OAuth 2.1 (this guide) |
| Inflection Developer API calls | ✅ OAuth 2.1 (this guide) — or a [PAT](/api-reference/authentication) |
| Claude AI assistant | ❌ Use MCP with DCR |
| ChatGPT integration | ❌ Use MCP with DCR |
| Other MCP DCR compatible AI | ❌ Use MCP with DCR |
## Prerequisites
Before you begin, ensure you have:
* Access to the Inflection Settings panel
* A redirect URL for your application (can be localhost for testing)
1. Log in to your Inflection account
2. Navigate to **Settings** → **Connected Apps**
3. Click **Create App Credentials**
4. Fill in the required fields:
| Field | Description | Example |
| - | - | - |
| App Name | A descriptive name for your application | "My Integration App" |
| Redirect URL(s) | The URL where users will be redirected after authentication | `https://your-app.com/callback` or `http://localhost:3000/callback` |
| Description | Optional description of your app's purpose | "Integration for marketing automation" |
5. Click **Connect** to create the app
#### Important: Save Your Credentials
After creating the app, you will receive:
* **Client ID** - A public identifier for your app
* **Client Secret** - A confidential key (keep this secure!)
**Store these credentials securely. The Client Secret will not be shown again.**
Use these endpoints for authentication (you can also discover these via the [well-known endpoint](https://auth-v2.inflection.io/.well-known/oauth-authorization-server)):
| Endpoint | URL |
| - | - |
| Authorization | `https://auth-v2.inflection.io/oauth2/authorize` |
| Token | `https://auth-v2.inflection.io/oauth2/token` |
OAuth 2.1 requires PKCE for enhanced security. Here's how the flow works:
#### 3.1 Generate PKCE Parameters
Before starting the flow, generate these values:
1. **Code Verifier**: A cryptographically random string (43-128 characters)
2. **Code Challenge**: Base64-URL encoded SHA256 hash of the code verifier
Example (JavaScript):
```javascript theme={null}
// Generate code verifier
function generateCodeVerifier() {
const array = new Uint8Array(32);
crypto.getRandomValues(array);
return btoa(String.fromCharCode(...array))
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=/g, '');
}
// Generate code challenge
async function generateCodeChallenge(verifier) {
const encoder = new TextEncoder();
const data = encoder.encode(verifier);
const digest = await crypto.subtle.digest('SHA-256', data);
return btoa(String.fromCharCode(...new Uint8Array(digest)))
.replace(/\+/g, '-')
.replace(/\//g, '_')
.replace(/=/g, '');
}
```
#### 3.2 Request Authorization
Direct the user to the authorization URL:
```
https://auth-v2.inflection.io/oauth2/authorize
?response_type=code
&client_id=YOUR_CLIENT_ID
&redirect_uri=YOUR_REDIRECT_URI
&code_challenge=YOUR_CODE_CHALLENGE
&code_challenge_method=S256
&scope=inflection_app
```
| Parameter | Required | Description |
| - | - | - |
| response\_type | Yes | Must be `code` |
| client\_id | Yes | Your app's Client ID |
| redirect\_uri | Yes | Must match the registered redirect URL |
| code\_challenge | Yes | The PKCE code challenge |
| code\_challenge\_method | Yes | Must be `S256` |
| scope | Yes | Must be `inflection_app` |
#### 3.3 Handle the Callback
After the user authorizes your app, they will be redirected to your redirect URL with an authorization code:
```
YOUR_REDIRECT_URI?code=AUTHORIZATION_CODE
```
#### 3.4 Exchange Code for Tokens
Make a POST request to exchange the authorization code for tokens:
```bash theme={null}
curl -X POST https://auth-v2.inflection.io/oauth2/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "redirect_uri=YOUR_REDIRECT_URI" \
-d "code=AUTHORIZATION_CODE" \
-d "code_verifier=YOUR_CODE_VERIFIER"
```
#### 3.5 Token Response
A successful response returns:
```json theme={null}
{
"access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOi...",
"refresh_token": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...",
"token_type": "Bearer",
"expires_in": 3600
}
```
| Field | Description |
| - | - |
| access\_token | Use this to authenticate API requests |
| refresh\_token | Use this to get new access tokens |
| token\_type | Always "Bearer" |
| expires\_in | Token lifetime in seconds |
Include the access token in the Authorization header for all API requests:
```bash theme={null}
curl -X POST https://campaign.inflection.io/api/v1/campaigns/campaign.list \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"page_size": 30, "page_number": 1}'
```
The same token works on the [Developer API](/api-reference/introduction), and it acts as the user who authorized the app (see [Authentication](/api-reference/authentication)):
```bash theme={null}
curl https://api.inflection.io/v2/contacts/by-email/jane%40acme.com \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
When your access token expires, use the refresh token to get a new one:
```bash theme={null}
curl -X POST https://auth-v2.inflection.io/oauth2/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=refresh_token" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET" \
-d "refresh_token=YOUR_REFRESH_TOKEN"
```
1. Create a new request in Postman
2. Go to the **Authorization** tab
3. Select **OAuth 2.0** as the type
4. Configure with these settings:
| Setting | Value |
| - | - |
| Grant Type | Authorization Code (With PKCE) |
| Callback URL | `https://oauth.pstmn.io/v1/browser-callback` |
| Auth URL | `https://auth-v2.inflection.io/oauth2/authorize` |
| Access Token URL | `https://auth-v2.inflection.io/oauth2/token` |
| Client ID | Your Client ID |
| Client Secret | Your Client Secret |
| Code Challenge Method | SHA256 |
5. Click **Get New Access Token**
6. Complete the login in your browser
7. Use the token to make API requests
**Note:** Ensure the Callback URL (`https://oauth.pstmn.io/v1/browser-callback`) is added as a Redirect URL in your Connected App settings.
**Prerequisite:** Make sure you have created an app in inflection for n8n (shared above)
1. Use the MCP Client (If you want to use the MCP) or create and HTTP Request (If you want to use an API)
2. Set **Authentication** to **MCP OAUTH2** or **Generic Credential Type (OAuth2)**
3. Configure a new OAuth2 credential:
| Setting | Value |
| - | - |
| Grant Type | PKCE |
| Authorization URL | `https://auth-v2.inflection.io/oauth2/authorize` |
| Access Token URL | `https://auth-v2.inflection.io/oauth2/token` |
| Client ID | Your Client ID |
| Client Secret | Your Client Secret |
| Scope | `inflection_app` |
4. Click **Connect** to authorize
5. n8n will automatically handle token refresh
1. **Never expose your Client Secret** in client-side code or public repositories
2. **Use HTTPS** for all redirect URLs in production
3. **Store tokens securely** - use encrypted storage or secure vaults
4. **Implement token refresh** before expiration to ensure uninterrupted access
5. **Use short-lived access tokens** and rely on refresh tokens for extended sessions
6. **Validate redirect URIs** match exactly what's registered in your app
### Tips
* Authorization codes are valid for 5 minutes and are single-use, exchange them promptly, as reusing a code invalidates the entire session
* If using Postman, ensure the callback URL in your Connected App matches Postman's callback URL
* For local development, `http://localhost` redirect URLs are acceptable
# In-App Chat
Source: https://docs.inflection.io/agents/in-app-chat
Use Inflection's in-app agent to ideate journeys, build segments, and more.
The Inflection in-app chat lets you build marketing assets by describing what you want in plain language. Describe an audience, email, or journey — the agent plans the work, builds it, and shows you the result inline, ready to review.
## Getting Started
Open **AI chat** inside Inflection. There is nothing to install. On your first message, the agent loads your business context (industry, ICP, common segments) so what it builds fits your account. The same agents are also available over the MCP connector for users working from Claude or ChatGPT.
**Try this in your first 10 minutes:** Type *"How many contacts opened an email in the last 30 days?"* to see the agent ground in your data, then *"Draft a re-engagement email for the ones who didn't."* You'll have a previewable email and a sense of the flow within minutes.
## What You Can Do Here
### Overview
| Function | Ideate | Create | Edit | Outcome |
| - | - | - | - | - |
| **Audiences** | ✅ | ✅ | ✅ | A saved, auto-refreshing dynamic list — reusable across journeys |
| **Segments** | ✅ | ✅ | via UI | A mutually-exclusive category for lifecycle/tier messaging |
| **Email** | ✅ | ✅ | ✅ | An on-brand, previewable email saved to your library |
| **Tokens** | ✅ | ✅ | ✅ | Verified personalization — including computed scores |
| **Journeys** | ✅ | ✅ | ✅ | A multi-step draft, ready for your review and activation |
| **Analytics** | ✅ | — | — | Dashboard-accurate performance, rendered inline |
### Build Audiences
Describe who you want to reach. The agent grounds in your real field values and saves a reusable dynamic list.
Consistent, reusable targeting without learning the filter UI.
**Example prompts:**
* "Build a list of enterprise accounts in California who haven't logged in for 30 days."
* "How big is that audience?" · "Save it as 'Enterprise – dormant'."
### Create and Edit Email
Draft from a brief, restyle elements in plain language, or edit a saved template **by name** — then preview before anything sends.
Review a thumbnail preview before you ship.
**Example prompts:**
* "Create a welcome email with a 20% offer and one clear CTA."
* "Edit the 'Trial Welcome' email — make the CTA green and tighten the hero copy."
### Build Segments and Tokens
Create ordered, mutually-exclusive segment categories (lifecycle, tier, engagement) and verified personalization tokens — including arithmetic scores such as a weighted engagement metric.
**Example prompts:**
* "Create lifecycle segments: New, Active, At Risk, Churned."
* "Build a score = 3×demo\_requests + 1×email\_opens over 90 days."
### Build Journeys
Describe a multi-step flow — emails, delays, branches, Salesforce sync, webhooks — and the agent assembles a **draft** you review and activate in the app.
**Example prompt:**
* "Draft a 3-step onboarding journey: welcome email, 2-day delay, branch on opened."
### Ask About Performance
Pull campaign and journey results in the same chat — dashboard-accurate numbers, rendered as a clean artifact.
**Example prompt:**
* "How did the Q1 newsletter perform — delivered, opens, clicks?"
### The Chat Experience
* **Live plan** — the agent shows its plan as a checklist and ticks items off as it works.
* **Streaming activity** — see which specialist and which tool is running, live.
* **Parallel-agent tree** — fan-out work (for example, several emails) renders as a tree, not a wall of text.
* **Inline artifacts and previews** — emails show a thumbnail; journeys render as a Mermaid diagram.
* **File uploads** — drop in a brief or asset and the agent works from it.
## Use Cases
**Brief to reviewable journey, in one sitting.** Paste a campaign brief; the agent sizes the audience, drafts the emails, and assembles the journey draft — review and activate when ready. Lifecycle teams run their whole program this way — onboarding, activation, re-engagement, win-back — even with a small team.
**The weekly newsletter, faster.** Draft and restyle the email, confirm the audience, drop it into the send journey.
**Live audience sizing on a working call.** Ask counts and compositions to pressure-test an idea before you build it — useful for demos and planning sessions.
## Limitations
**Drafts, not auto-activation.** You decide when a journey or send goes live.
**Segment sizes settle after save.** A new category populates within approximately 10 minutes; previews before then can overlap.
**Custom CSS lives in the editor.** Plain-language style edits cover common cases; bespoke `@media`/`