Connecting accounts

Connection

A consent screen at the service. We hold an encrypted token and call their API with it.

Login

You sign in once in the agent's own browser. No credential is stored here at all: the cookies live in that browser profile and the only thing recorded is which profile holds them.

API key

A key you paste. Encrypted at rest and never shown again.

No password of yours for any other service is ever stored, put into a model's context, written to a trace or written to a log. One-time codes may pass through a conversation, because they are single use and worthless afterwards.

The full OAuth path is built: the redirect, the callback, encrypted scoped tokens, refresh, and read-only access to Gmail and Calendar. It needs an operator to supply client credentials, and this installation has none, so the Accounts page says so rather than offering a button that cannot work.

Signing in with Google is a separate thing from connecting Google. Signing in asks for your identity and nothing else — no mail scope, no calendar scope. Reading your mail is a second decision, made later, with its own consent screen.

Requirements come from the definition rather than being declared by hand: adding a step that reads mail is the same act as requiring a Google account. Connecting happens once, while the agent is being built, and never in the middle of a run. A run that discovered halfway through that it needed an account has already failed at something, so the run button stays disabled until each requirement is connected or deliberately skipped.

This works. The Connect panel asks how you actually get into each site, because sites differ and guessing produces a stored password that can never be typed.

A password

Kept encrypted, and it comes back only for the site it belongs to. The agent types it on that site and nowhere else. The model never sees it — it is given a placeholder, and the password is never in a conversation, a trace, a screenshot or a log.

A texted code

Nothing to store. When the site sends one, the run stops and asks you for it, and carries on with the answer.

Continue with Google, Apple, a passkey or a captcha

Only you can complete these, so it stops and hands the browser to you. This is the one way in that is not automated, and it is marked on the agent that needs it.

Signing in is allowed to write, and only while signing in. Getting through a door is not the same act as buying something on the other side of it, and the two are judged separately.