Will connecting an app take 15 minutes — or 6 weeks?

GitHub OAuth Apps are instant and need no provider review, so you can have a working token in under 30 minutes, and new apps now get 8-hour tokens with refresh by default. The real friction is on the customer side: the only scope that covers private code, issues and PRs is `repo` (full read/write to every private repo the user can reach), and organisations that restrict OAuth Apps, as every new org does by default, hide their private repos until an org owner approves you, which is why GitHub recommends a GitHub App for this use case.

Hard: you can test in an hour, but every Gmail scope that reads mail or manages drafts is restricted. Before arbitrary users can connect without warnings, you need brand verification, restricted-scope review (Google estimates about 6 weeks) and an annual third-party CASA security assessment paid by you. Until then, you're limited to 100 test users whose refresh tokens expire after 7 days, or a lifetime cap of 100 users who click through an 'unverified app' warning.

Posting as a member is self-serve and works within the hour (Share on LinkedIn grants w_member_social). Posting as a company page requires the vetted Community Management API: a legal-entity check, a Page-verified app, a capped Development tier, then a screencast review for Standard tier with no published timeline. Self-serve tokens last 60 days with no programmatic refresh, so an always-on agent needs a plan for re-consent or for getting refresh-token access.

Easy: a public connection (Notion's new name for a public OAuth integration) is self-serve in the Developer portal, and the docs say no Notion review is needed unless you want a Marketplace listing (5-10 business days). The real problem for an agent is the page picker: users grant access only to the pages they pick, so your agent sees nothing else until they re-authorize or share more pages. Also, refresh tokens rotate on every refresh.

OAuth works against your own free Developer Edition org within about an hour, but serving other companies' orgs now means a packaged External Client App inside a second-generation managed package that each customer's admin installs. New connected apps have been blocked since Spring '26, uninstalled apps have been blocked for new users since September 2025, and refresh tokens idle for 30 days expire starting November 4, 2026 (production), so plan your packaging, the admin install step, and token keep-alive before you write any API code.

Getting a bot token in your own workspace takes minutes, and you can distribute to other workspaces the same day without review. But since 29 May 2025, a commercially distributed app that isn't approved for the Slack Marketplace is throttled to 1 request/minute and 15 messages per call on conversations.history and conversations.replies, so an AI agent that reads channel context effectively needs Marketplace approval. That approval requires 10+ active workspaces before you can submit, an enhanced review for `*:history` scopes, and up to about 12 weeks of review.

OAuth credentials for a user-managed General app are instant and work on your own Zoom account in under an hour, but no external Zoom account may use the app until it passes Zoom's mandatory Marketplace functional + security review (even 'Unlisted' apps are reviewed), so budget days of prep and one to several weeks of review. Zoom's API Terms also forbid using Customer Content obtained via the API (recordings, transcripts) to train or fine-tune AI models without Zoom's written permission or the account owner's explicit consent.

Linear OAuth setup is self-serve and fast, supporting instant public distribution without mandatory app review. Workspace admin approval is required for customers installing third-party integrations.

Plausible Analytics does not offer OAuth 2.0 for third-party integrations, authenticating API access exclusively via Personal Access Tokens. Users must manually create an API key in their Plausible account settings and provide it to your application.