For AI service providers · Guide
How to connect client tools without sharing passwords in chat
Use a supported client authorization flow instead of copying passwords into messages. Agentic Workers can issue an app-connection invitation for a selected Super Agent. The client authorizes its account through the supported provider flow; the operator then verifies account identity and performs a read-only test. Some apps use keys or provider-specific fields.
By Agentic Workers Team · Published · Updated
Responsibilities and evidence
Agree on the owner and retain a safe evidence reference for each responsibility.
- Service scope
- Provider drafts; client accepts. Evidence: agreed output and stop conditions.
- Account ownership
- Client and provider confirm owners. Evidence: account inventory without secret values.
- Configuration
- Provider sets up the intended workspace and agent. Evidence: reviewed settings.
- Action review
- Named reviewer checks supported actions. Evidence: request and decision.
- Acceptance
- Client or delegated reviewer checks the result. Evidence: accepted artifact.
- Exit
- Account owner and provider remove access. Evidence: handoff and denied-access check.
1. Choose only the required access
List the app, resource and read or write action the service needs. Confirm the client account owner and administrator requirements. Check the app catalog before promising support for a particular tool.
2. Send the scoped invitation
In the selected agent’s customer portal, choose the required apps and expiry. The agent must use Agent only integration mode. Have the client complete the supported authorization. Do not place secrets in prompts, screenshots or handoff notes.
3. Verify and plan revocation
Confirm an actual read from the intended account and resource. Test supported write approvals separately. At exit, revoke active invitations and disconnect accounts, then check remaining consent with the source provider.
Example provider workflow. Adapt it to the client’s agreed scope.
- 01
Step 1: Choose only the required access
- 02
Step 2: Send the scoped invitation
- 03
Step 3: Verify and plan revocation
Fit and limitations
- Good fit
- Providers applying this process to an agreed client service.
- Poor fit
- Treating this checklist as an automatic product feature or a substitute for a client agreement.
- Known limits
- These are operating recommendations. Test each supported product path in the target workspace and plan. Examples are not performance, pricing or security benchmarks.
Sources and evidence
Documentation establishes the scope of a claim. It does not replace an acceptance test in your client’s environment.
| Source | What it supports | Checked |
|---|---|---|
| Customer portal operating notesProduct documentation | Upload and app-connection invitations are scoped to a selected agent. Revoking an invitation is separate from disconnecting an account. | |
| Connect tools to a Super AgentProduct documentation | Authorization requirements depend on the provider. Verify the actual account and resource access with a read-only request. | |
| Agent tools and review guidanceProduct documentation | Supported tool actions can require approval. Test the exact tool and runtime; coverage is not universal. |
Questions providers ask
Who is responsible for the result?
The provider names an operator; the client names the person who can accept the deliverable. The platform does not replace those responsibilities.
What evidence should we retain?
Keep the source date, workspace and agent, expected output, review decision and artifact reference. Exclude credentials and unnecessary personal data.
When should we stop and review?
Stop when the account, recipient, output or permissions differ from the agreed scope, then resolve the exception before continuing.
Set up one client service
Set up the client workspace, connect its tools and review the first deliverable. Use a tested delivery path, such as Telegram, so the client can receive work in chat. Track operating costs and review effort before pricing a recurring service.
Sign up now