Skip to main content

Set up Procore service credential

A Procore service credential lets a Glean agent access Procore through a Developer Managed Service Account (DMSA). You create a Procore developer app, enable service account authentication, install the app in your Procore company, and add the service account to the projects the agent should access.

Glean uses the OAuth 2.0 Client Credentials flow to obtain short-lived access tokens. The agent never sees the client secret or access token.

  • Authentication: OAuth 2.0 Client Credentials using a Procore Developer Managed Service Account
  • Scope: The Procore company and projects that the app and service account can access
  • Access: Read access by default; write operations require approval

Prerequisites​

  • A Procore company where you have administrator access.
  • Permission to create and manage Procore developer apps.
  • A Glean administrator who can create service credentials.
  • The Procore service credential template enabled for your deployment. If you don't see it under Service credentials, contact your Glean representative.
  • A Procore developer app. Developer sandbox credentials are not supported because Glean authenticates directly through Procore’s production login endpoint.

Create a Procore developer app​

  1. Go to Procore Developer Apps and sign in with your Procore account.
  2. Select Create a New App and enter a name, such as Procore Glean.
  3. In the Configuration Builder, select Add Component under Data Connector Components.
  4. For Component Type, select User Level Authentication and Service Account Authentication.
  5. Grant the Company Directory Admin permission, then select Save Component.
  6. Select Create Version, then confirm to create the first app version.
  7. Select Promote Version to create a production version of the app.

Create the service account credentials​

  1. Open the production version of the developer app.
  2. Go to OAuth Credentials.
  3. Select Reset Client Secret to generate production credentials.
  4. Copy the Client ID and Client Secret. Store the client secret securely, Procore shows it only when it is issued or reset.

Find your Procore Company ID​

Find the Company ID in the Procore URL. It is the number after app.procore.com/.

For example, in https://app.procore.com/1234567, the Company ID is 1234567.

Install the developer app in Procore​

  1. Return to the developer app's Configuration Builder.
  2. Copy the Production App Version Key.
  3. Sign in to Procore and open the company where you want to use the app.
  4. Go to the App Management company tool.
  5. Select Install App, enter the Production App Version Key, and select Install.

Add the app user to projects​

The DMSA app user can access only the projects where an administrator has added it.

  1. In Procore, go to Company level → Directory.
  2. Find the app user for the developer app. Its username usually starts with the app name, such as procore-glean-. The user's first and last name fields might be blank.
  3. Apply a permission template, or grant explicit permissions, for the Procore tools the agent needs. At minimum, grant read access to Projects, RFIs, and Submittals. Add Specifications, Drawings, and Daily Logs if the agent needs those tools.
  4. Add the app user to each project that the agent must access.
  5. Select Add Integration for the app user to add it to all new projects automatically. For existing projects, use Add All if it's available, or add the app user to each project manually.
tip

Grant access only to the projects and Procore tools the agent needs. The service account cannot access projects that you do not explicitly assign to it.

Create the service credential in Glean​

  1. In Glean, go to Admin console → Platform → Tools → Service credentials.
  2. Select Add, then select Procore.
  3. Fill in these fields:
    • Credential name: A human-readable name, such as Procore — Production.
    • Description: A short description of the Procore company and projects covered by this credential.
    • Company ID: The numeric Procore Company ID.
    • Client ID: The OAuth Client ID from the Procore developer app.
    • Client Secret: The OAuth Client Secret from the Procore developer app.
    • Audience: The people or groups who can attach this credential to agents.
  4. Select Save.

Glean stores the client secret encrypted and uses it to obtain short-lived Procore access tokens. It injects authentication and company routing into requests sent to Procore; the agent does not receive the credential values.

Attach the credential to an agent​

  1. Go to Agents in Glean and select the agent.
  2. Open the Tools tab.
  3. Under Service credentials, select the Procore credential you created.

The agent can now use the Procore tools that correspond to the credential. It can read Procore data, such as projects, RFIs, submittals, drawings, specifications, and daily logs, in the projects and tools where the service account has permission.

Verify it works​

Ask the agent to perform a read action, such as:

List the Procore projects available to you.

The result should include only projects where the DMSA app user has access. If the agent needs to use a company scoped operation, such as listing projects, the Procore Company ID is used to route the request.

warning

Test write operations only when you are ready to approve a change. Create, update, and delete operations in Procore require explicit user approval.

What the agent can do​

Depending on the Procore permissions granted to the DMSA app user, the agent can:

  • Read projects, RFIs, submittals, drawings, specifications, and daily logs.
  • Create, update, or delete Procore records when a user approves the operation and the app user has the required write permissions.
  • Work only with the company and projects configured for the service account.

Read operations are unrestricted by the Glean approval flow. Mutations are approval-required because Procore records can affect project workflows and notifications.

Security and operational notes​

  • Dedicated app: Create a developer app used only for Glean agent access.
  • Least privilege: Grant the DMSA app user access only to the required Procore tools and projects.
  • Company routing: Each credential is bound to one Procore company through its Company ID.
  • Injected server-side: Glean stores the client secret encrypted and injects authentication into requests. Never add the client secret or bearer token to agent instructions.
  • Verify writes: After a create or update, read the record back to confirm that the values were persisted.
  • Rotation: Reset the client secret in Procore, update the Client Secret in Glean, test the credential, and then revoke the old secret if Procore provides that option.
  • Revocation: Remove the service credential in Glean, uninstall the app from Procore, or remove the DMSA app user from projects to cut off access.

Troubleshooting​

See also​

Last updated on
© 2026, Glean Technologies, Inc.
Was this page helpful?
On this page