Connected Accounts
Some integrations don't store a shared API key. Instead, each person signs in to the provider with OAuth and grants access to their own account. These are OAuth-brokered integrations, used for providers' MCP servers and APIs. When an agent acts for you, it uses your connection and only the access you granted.
You manage your connections under Settings → Connected Accounts (in the personal group of Settings).
Connection types
| Type | Who it belongs to | Used by |
|---|---|---|
| Personal connection | One user | Agents acting for that user in chats and interactive runs. |
| Tenant service connection | The project, authorised by an administrator | Scheduled and autonomous runs where no user is present. |
| Project connection (GitHub) | The whole project | Agents working on the repositories you choose. Connected once for the whole project, not per person. |
The Connected Accounts page
| Section | Contents |
|---|---|
| Connected accounts (yours) | Each provider you've connected, with its status, the scopes granted (hover for the raw scope list) and the date connected. |
| Available to connect | OAuth-brokered integrations in this project you haven't connected yet. |
| Project connections | The project's GitHub connection: Connect GitHub, Add another account, or Manage repositories (which opens Settings → Repositories). |
| Tenant service connections | Shared connections used by autonomous runs. Shown when any exist, or when you can create one. |
| Other members' connections | Shown to platform administrators only. |
Statuses
| Status | Meaning |
|---|---|
| Active | Working. |
| Needs reconnect | The provider grant expired or was revoked. Agents using it fail until you reconnect. A warning banner appears at the top of the page. |
| Revoked | The connection was revoked. |
| Pending | The sign-in hasn't completed. |
Connect an account
- Go to Settings → Connected Accounts.
- Under Available to connect, click Connect next to the provider.
- Sign in and approve access in the pop-up window.
- The connection appears under your connected accounts as Active.
You can also connect from a chat. When an agent needs a provider you haven't connected, the chat shows a Connect card that runs the same sign-in flow. See Chat.
To refresh a connection marked Needs reconnect, click Reconnect. Reconnecting replaces your stored grant.
Disconnect an account
Click Disconnect and confirm. Agents lose access to that account until you reconnect. Your data at the provider isn't affected. The stored tokens are deleted.
Connections for unattended runs
Scheduled and autonomous runs have no user to sign in. For those, a project administrator can create a tenant service connection:
- An integration must opt in: on the integration's Details tab, turn on Allow delegated-autonomous connections.
- On Settings → Connected Accounts, a project administrator clicks Connect for autonomous use on that provider.
- After sign-in, the connection appears under Tenant service connections and is shared across the project.
Unattended runs act with that connection's access, so connect an account whose permissions suit unattended jobs. Project administrators can Reconnect a service connection; removing one requires a platform administrator.
Privacy and isolation
- Your connection's tokens can be read only by the platform runtime acting for you. Other members, and administrators, can't use your personal connection.
- Platform administrators can see that other members' connections exist (provider, status, scopes) and can disconnect them, but they can't read their tokens.
- Deleting a user removes their connections.
Which integrations appear
Only integrations whose authentication is OAuth-brokered appear under Available to connect. These are normally installed from a platform template or the Marketplace. Some providers need the organisation's own app registration with the provider before anyone can connect; an administrator supplies it when installing the integration.