Migrate an app integration through owner reauthorization

Inventory behavior and authorization separately

A migration has two kinds of state: workflow behavior such as queries and routing, and provider authorization such as OAuth grants or stored API keys. Preserve the former deliberately without assuming the latter can be copied. List each app, intended owner account, necessary operations, provider resource IDs and outstanding actions. Record which old effects are unresolved before enabling the new runner. An integration that lists issues and another that creates them may share an app name while requiring different scopes and approval rules. The migration plan should describe actual behavior, not merely a list of service logos.

Rebuild authorization through the hosted owner flow

Lupin connections use operator-configured Composio auth blueprints and provider-owned credentials. The owner authorizes the intended account through the hosted link rather than pasting an old refresh token into tool arguments. A token issued to another OAuth application can have different scopes, audience and lifecycle constraints; do not promise credential portability without a supported provider process. Confirm app readiness in Lupin’s catalog first, then start one saved-key connection attempt. This also discloses the new Composio dependency honestly so the owner knows which service participates in authentication and execution.

Translate operations from real discovered schemas

After activation, discover tools under the new connection and review each required operation’s input schema and concrete version. Map the old workflow’s canonical fields to those actual parameters, checking output shape and pagination rather than relying on similar tool names. Save the new account revision with each proposed action. For example, an old repository label and issue title might map cleanly, while attachment handling or search filters need another step. Mark unsupported behavior explicitly instead of using arbitrary proxy requests or credential overrides that the controlled execution route does not accept.

Close uncertain effects before switching writers

Pause new writes in the old runner and reconcile outstanding operations against the external application. A lost response can hide a completed issue creation or sent message; replaying that task in Lupin under a new operation identity can duplicate it. Migrate stable external resource references, not assumptions that every unfinished local job has no effect. Begin with reviewed discovery and owner-approved narrow operations, then enable the new write path. Retain old history long enough to resolve references while preventing both systems from simultaneously processing the same outward task.

Revoke the old grant after validation

Once the owner verifies the intended account and the new workflow meets its acceptance cases, retire the old runner and revoke its authorization through its supported provider process. Removing a token from one configuration file is not proof that the grant no longer exists. Keep a dated record of the new connection’s purpose, owner and scope review without storing secrets. Test rollback expectations before revocation: a rollback may require another owner authorization rather than restoring copied credentials. This makes portability a controlled change in trust and execution behavior, with fewer hidden dependencies than a token-export shortcut.

Compare a single workflow before cutover

Choose one synthetic issue-triage task and compare selected account, query meaning, pagination, output fields and proposed write under both integrations. Record differences before changing production routing. The acceptance decision should concern the workflow’s behavior and authorization, not whether the new setup can merely display the same app name or owner alias.

Sources & verification

Reviewed against current checked-in Lupin routes, shared contracts and official provider references. No live calls, OAuth authorizations, app actions or purchases were performed.

• Lupin connections ↗Checked 2026-11-05
• Composio authenticating tools ↗Checked 2026-11-05
• Google API OAuth scopes ↗Checked 2026-11-05

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.