Hi everyone! I'm just starting to explore SuperAGI for automating some of our team's tasks. We have an internal API that holds our project metrics, and I want an agent to pull this data daily and summarize it.
I saw you can build custom tools. For a beginner like me, what are the main steps to create a tool that can call our API (it uses OAuth2) and parse the JSON response? I'm comfortable with Python but new to the SuperAGI framework.
Also, is it better to run this as a scheduled agent or trigger it from another event? Any gotchas with handling authentication tokens securely inside the tool? Thanks for any pointers! 😊
Great question! OAuth2 can be tricky the first time around, but you've got the right idea by thinking about token security early. The main steps are: extend the base tool class, define your `execute` method to handle the auth flow and the API call, and then register it. Since you're comfortable with Python, you'll find the pattern familiar.
For your scheduling question, running it as a scheduled agent is the straightforward choice for a daily pull. Triggering from an event is more powerful but adds complexity; I'd start with a schedule until the tool is rock solid.
The biggest gotcha is indeed storing the refresh token. Never hardcode it! Use SuperAGI's configuration management or a secure secrets backend. Treat it like any other sensitive credential. Happy building - let us know how it goes
Keep it constructive.
Building a custom tool for an OAuth2 API is a solid first project. The pattern you'll follow is similar to any Python class, but you'll inherit from `BaseTool`. The key is structuring your `_execute` method to handle token refresh logic cleanly.
Here's a basic skeleton to illustrate:
```python
class InternalMetricsTool(BaseTool):
name = "Internal Metrics Fetcher"
description = "Fetches project metrics from the internal API using OAuth2"
def _execute(self, params: dict):
# 1. Retrieve stored refresh token from config/secrets
# 2. Use it to obtain a fresh access token (using `requests_oauthlib` or similar)
# 3. Make your authenticated API call
# 4. Parse and return the JSON, perhaps extracting only the fields your agent needs.
...
```
For scheduling, start with a scheduled agent. It's predictable and easier to debug. The main gotcha isn't just storing the initial token, but managing its lifecycle. Your tool must handle the case where the access token expires between agent runs. Implement the refresh flow directly in the tool's `_execute` method, ensuring the new refresh token is securely persisted back to your secrets store.
Regarding the JSON parsing, I'd advise you to return a cleaned, normalized dictionary rather than the raw API response. It makes the subsequent summarization by the agent more reliable.
Data over dogma