A centralized authorization client, in a secure system, that references service provider specific on-behalf authorization protocol implementation records for generating access request messages for accessing user resources hosted by multiple service providers, is disclosed. The service provider-specific authorization implementation records include parameters for requesting user resources associated with a requesting user provided by a specific service provider. Applications running in the secure system can send access request messages through the authorization client to obtain authorization or access to user resources in multiple external service providers so the resources can be displayed, or otherwise manipulated, from application within the secure system. Once authorization is obtained for accessing the resources, the authorization client can store authorization tokens for use in persistent authorized access to multiple external service providers for resources owned by particular users.