How Hevo Authenticates Sources and Destinations using OAuth

Hevo has a central authorization service that takes care of user authentication and authorization across all the Hevo regions. This also covers authorization for:

• The various OAuth-based Sources, Destinations, and Activate Targets that Hevo integrates with
• Google sign-ins
• Enabling Slack notifications

The authorization service is hosted centrally in the Hevo Asia region (with a backup service in the US region coming soon) for security purposes. It follows the design principles of other services operating at a global scale, such as Amazon and Google, whereby a user can log in to any region or any service with a single account. This design also enforces that no application data is stored or exchanged by the authorization service. The Pipeline created in your account-specific region (https://<region>.hevodata.com) handles all the application data, with the Authorization service providing just the required access token.

To enable the OAuth service to run, you must, therefore, whitelist the Hevo Asia IP address.

The following example illustrates how the authorization service works.

Revision History