Before your app can read a single email or calendar event, the user has to give it permission. That permission is an OAuth handshake with their provider, Google, Microsoft, or another, and getting it right means redirect URIs, scopes, token exchange, and refresh tokens. Hosted OAuth hands that whole dance to Nylas: you send the user to a hosted authorization URL, they approve access at their provider, and you get back a grant you can use to call the email, calendar, and contacts APIs. This post walks the flow with the API and shows the CLI command that does it in one step.
It's a worked use case rather than an endpoint tour, covering the hosted OAuth flow from two angles: the HTTP endpoints your backend calls and the nylas CLI for connecting an account from the terminal. I work on the CLI, so the commands below are the ones I reach for when I want a grant to test against fast.
What a grant is, and the two-step flow
The thing you're after is a grant: a stored connection to one user's account that the API uses to act on their behalf. Every email you read, event you create, or contact you fetch is scoped to a grant_id, so connecting an account means producing one. Hosted OAuth produces it in two steps, and understanding the split is most of the battle.
