Skip to main content

​
Overview

Connectors let your agents use services such as Gmail, Slack, and Salesforce. Add the connectors an agent needs, then connect an account for each service. You can connect multiple accounts and choose which one the agent uses. A connector provides tools for a service. Its connected accounts provide authentication, such as OAuth authorization or an API key. Secrets are separate: they store values an agent uses in its code sandbox. See Code Sandbox & Secrets.

Personal connectors

Private to you. Perfect for individual work, testing, and personal accounts.

Team connectors

Shared with your team. Use a team account when everyone should work through the same service account.
Start with personal connectors for most work. Use team connectors when your team needs agents to use shared accounts.

​
Personal vs team connectors

​
Connect an account

Connect an account once, then reuse it across your agents. A personal account is available to you; a team account is available to members of that team.

​
Connect a personal connector

1

Go to your Connectors page

Visit your Connectors page, or select Customize in the left sidebar, then Connectors
2

Choose a service

Open All or Discover, find the service you need, and start its connection process. If it is already listed under Connected, use the + next to the service to add another account.
3

Authenticate

OAuth (most services): Click “Connect” and follow the authorization flow. No manual token management needed. Examples: Gmail, Slack, Microsoft services.API Keys (some services): Paste your API key directly. Examples: OpenAI, AWS, Anthropic.
4

Set as default (optional)

If you connect multiple accounts for the same service (for example, three different Gmail accounts), you can choose which one is your default. If you only have one account connected for a service, it’s automatically your default.
Other members do not get direct access to your personal credentials. If you explicitly set a connector to Agent-owned, people who can use that agent can act through the pinned account. See Agent-owned credentials.

​
Connect a team connector

Team connectors are shared integrations that everyone on a specific team can use. They are scoped to that team, and a team’s default account applies when the agent uses Use Team Default. Open the team’s Connectors page to add an account. See Add team connectors for the steps.

​
Choose which account to use

A connector can have several connected accounts for the same service, such as three Gmail accounts. The agent’s Account selector determines which one it uses.
Rule of thumb: by default, everyone uses their own account (Use Personal Default). Switch to a team account only when everyone should act as the same shared login, such as a support inbox or a team Google Drive.

​
In agents

Open a connector in the agent’s Connectors section to choose its account. Agents can be shared with your organization or specific people, so account selection must also work for whoever runs the agent. How to choose:

Everyone as themselves

Pick Use Personal Default. Each person who runs the agent uses their own account, so data stays private to each user. This is the default.

Everyone as one shared login

In a team agent, pick Use Team Default (or pin team accounts). Every team member who runs the agent uses the same shared account.
Which account does the agent run with? It depends on the option you pick and who runs the agent:
  • Use Personal Default (the default for both personal and team agents): the agent uses the running user’s own default account. Share the agent and each person uses their own account, so data stays private to each user.
  • Use Specific Accounts uses the pinned accounts when available. With several pinned, the agent starts with the default account (marked Default) and can pick another for each call. Each runner can only use the pinned accounts they own or that someone shared with them. For user-owned connectors, a missing personal pin or a user without access to the agent’s home team can fall back to their personal default. A missing team pin doesn’t fall back for users who have access to that team. Repair the selection in the agent’s settings.
  • Use Team Default uses the shared team default when the running user has access to that team. Without that access, the running user can use their personal default instead.
  • Agent-owned credentials are the exception. When you explicitly set a connector to Agent-owned, everyone who can access the agent uses the pinned accounts when tools are called, including people you share it with. See Agent-Owned Credentials below.

​
Personal agents

Personal agents offer two choices. A personal agent can still be shared, so the table shows which account is used when you run it versus when someone you shared it with runs it.
Credential and accounts section with User-owned selected and the Account menu showing Use Personal Default and Use Specific Accounts, Pick the personal accounts this agent uses

​
Team agents

Team agents have a third option: Use Team Default. This lets all team members share one account without each person needing their own credentials for that service.
Changing a team agent’s connected account affects everyone on the team, so a confirmation dialog appears first. You can cancel, make a personal copy of the agent instead of changing the shared one, or select a team account to proceed.
Confirmation dialog asking if you want to change the account this team agent uses
For configuration steps, see Agents: Account selection. For Slack-specific setup, see Using Agents in Slack.

​
Use more than one account on an agent

Pin several accounts for the same app when an agent needs more than one, for example two Slack workspaces or a personal and a shared inbox.

​
How does the agent choose an account?

The agent sees each pinned account by its name and knows which one is the default. Every action uses the default account unless your request points to another one. The agent then switches to that account for that action only, so one task can read from one account and write to another. If it can’t tell which account you mean, it asks. For example, an agent has two Slack workspaces pinned, Acme (the default) and Beta: Name the account in your request, or in the agent’s instructions for a rule that should always apply, for example “Send customer replies from the support inbox.”

​
Set it up

1

Connect every account first

Open your Connectors page (Customize > Connectors in the left sidebar) and connect each account. On the app’s tile, select Connect for the first account and Add account for the next. You can’t add accounts from the agent. For a team agent, connect them on the team’s Customize > Connectors page.
2

Open the connector on the agent

Open the agent, go to the Agent tab, and select the connector in the Connectors section (or View all, then the connector). The connector’s detail view opens on the right.
3

Choose Use Specific Accounts

Under Credential and accounts, keep User-owned selected (User/Team-owned on team agents). Open the account menu, which shows Use Personal Default, and choose Use Specific Accounts (“Pick the personal accounts this agent uses”).
Slack connector detail view, Credential and accounts section with User-owned selected and the account menu open on Use Personal Default and Use Specific Accounts, Pick the personal accounts this agent uses
4

Pick the accounts

Orchestrivo pins every account you can see and shows how many, for example 2 accounts selected. Select that box to open the list, then clear the accounts the agent shouldn’t use. Search accounts filters a long list. The account marked Default is the one the agent tries first. At least one account must stay selected.
5

Save

Select Save at the top right of the panel (or press Ctrl/Cmd + S). In the agent’s connector list, the connector then shows the first account’s name and how many others are pinned.
On a shared agent with User-owned accounts, each person can only use the pinned accounts they own or that are shared with them. To have everyone use the same accounts, choose Agent-owned instead and pick the accounts there. See Agent-owned credentials.

​
Agent-owned credentials

By default, connectors are user-owned: each person who runs the agent uses an account available to them, following the personal and team selection rules above. Agent-owned credentials change this. When a connector is agent-owned, everyone who can access the agent uses the accounts or connection you pinned, without getting direct access to the underlying credential.
Selection and ownership are separate. Choosing a specific account decides which account the agent uses. Ownership decides whose identity runs the tool. Selecting a specific account does not make it agent-owned on its own. You turn that on explicitly.

​
Which ownership mode to use

User-owned / User/Team-owned

Each person who runs the agent acts as themselves, using the account available to them. Pick this when a shared agent should work on each user’s own data and that data should stay private to each user. This is the default.

Agent-owned

The agent is bound to the accounts you pin, and everyone who can access it acts as those accounts no matter who runs the agent. Pick this when the agent should always use the same connected accounts, such as a shared service account or a support inbox, so the agent always behaves the same way for every user.

​
Turn on agent-owned for a connector

1

Open the connector

In the Agent tab, expand Connectors and open the connector’s detail view.
2

Choose Agent-owned

Under Credential and accounts, choose one of:
  • User-owned (labeled User/Team-owned on team agents): “Everyone uses an account available to them.” This is the default.
  • Agent-owned: “Everyone uses the accounts you pick.”
Select Agent-owned. An accounts selected box appears below it; open it to choose which accounts everyone uses. If none were pinned yet, Orchestrivo pins all the accounts you can see. You can clear any account except the last one, and Search accounts filters a long list.
Accounts are added on the Connectors page, not here. On a team agent with no team account, choosing Agent-owned first asks you to Select team account.
3

Save

Select Save at the top right of the panel (or press Ctrl/Cmd + S). Back on the Agent tab, the connector shows Agent owned under its name.
Agent tab Connectors section listing Apollo, Exa, Firecrawl, Google Drive with Agent owned under its name, and Parallel
Agent-owned credentials and public link sharing cannot be used together. A pinned credential would otherwise be exposed to the public. If the agent’s Public link access is Anyone with the link, choosing Agent-owned asks you to turn off the public link first. Once an agent has an agent-owned credential, Public link access is unavailable in its share dialog and reads “Unavailable when using agent-owned connectors or secret.”
Agent-owned pins are tied to the workspace they live in. Cloning an agent, using it as a template, or moving it to another workspace removes the agent-owned pin, and the connector reverts to user-owned in the new location.

​
Enterprise availability

For organizations, agent-owned credentials are restricted by default. An admin turns them on per custom role with the Agent-owned credentials feature toggle. Members whose roles do not grant it see the Agent-owned option disabled. You can only pin an account you have access to, and Orchestrivo re-checks that when the agent is saved. The same organization permission covers agent-owned secret bindings. With permission to edit a custom agent, you can pin a personal or team Vault secret you can access for everyone who can use the agent, including people outside its home team. This grants use through the agent, not direct Vault access, and cannot be combined with Anyone sharing.
Agent-owned credentials are required for agents that let Slack members without Orchestrivo accounts run them. Those people have no accounts of their own to authenticate with, so any user-owned connector fails for them. See Organization Service Accounts for Slack Agents.

​
Team API keys

API connector calls don’t accept team API keys and return 403. This covers the /api/v1/mcp/* endpoints and client.mcp in the SDK. To reach the team’s shared accounts, use a personal API key and pass team_id. The call then runs under your own limits. A team API key can’t use a member’s personal default, even when the request names that member. It also can’t read that member’s personal secrets, saved website logins, or browser profiles. If you need to use your own personal account or credentials, use your personal API key. Agent-owned credentials follow the ownership and sharing rules above. For chat files or personal agent files, use a personal API key whose account can access the conversation or file. A team API key cannot open those files, and switching keys does not grant access by itself. Shared team files remain available according to their permissions.

​
Manage your connectors

Visit your Connectors page (Customize > Connectors in the left sidebar) to see all your personal connectors, last refresh time, connected services, and defaults. Accounts that can’t work as they are sort first under their app and show an orange badge: Restricted (your role or admin blocks the app), Reauth needed, or Refresh failed (temporary; Orchestrivo retries).
OAuth connectors automatically renew access tokens when the saved authorization is still valid. If a connected service no longer accepts the saved OAuth authorization, refresh that account and complete authorization again. A temporary connection or renewal failure is different: retry the task first, because it does not necessarily mean the authorization has been revoked.If the saved login is rejected, retry once. If it fails again, refresh the account the agent was actually using, not another account for the same service. A connection prompt may identify that account.
  1. Go to your Connectors page
  2. Open that account’s three-dot menu and choose Refresh (or Reauth when the account shows Reauth needed)
  3. Complete the authorization flow again
Then retry the task. Repeatedly asking the agent to use the account does not repair revoked authorization. If a pinned account was removed, check the account-selection rules above rather than refreshing an unrelated account.
Connecting your own account does not repair an unavailable agent-owned credential or change a saved team pin.
  • Agent-owned credential: the agent owner must repair the configured credential in the agent’s settings.
  • Missing specific team pin when you have access to that team: the saved selection must be changed. If you cannot edit the agent, ask its owner to select an available account. Refreshing another account does not change the pin.
  • Organization restriction: request access from an admin. A role restriction is a permission issue, not an authentication failure, and refreshing the connector does not remove it.
An HTTP request error is not necessarily a credential problem. Refreshing an account does not fix a non-authentication HTTP error. Before retrying an action that sends, creates, or updates something, check whether it already completed to avoid duplicating it.
  • Transient error, such as HTTP 408 or 5xx: retry once. If it still fails, stop repeating the request and try again later. An HTTP/protocol failure without a status also gets one retry.
  • Non-transient HTTP error, such as HTTP 400 or 404: check the tool arguments. Retrying the same bad request does not fix it. If the arguments are correct, check the connector’s configuration.
  • HTTP 401: the saved login was rejected. Follow the targeted account-refresh guidance above if one retry also fails.
  • HTTP 403: the connected account may lack permission for the action. Check access rather than treating it as a rejected login.
  • HTTP 429: this is a rate limit. Wait before retrying; refreshing the connector does not remove the limit.
  1. Go to your Connectors page
  2. Find the connected account to remove, open its three-dot menu, and choose Revoke
  3. Confirm removal
The account’s authorization is removed. A missing personal pin can fall back to the running user’s personal default. A missing specific team pin does not switch to another team account, and an unavailable agent-owned credential needs repair in the agent’s settings. Check the account-selection rules above before retrying.
Personal default: Your default account for a service. An agent uses it for your tasks when its account setting is Use Personal Default.Team default: The team’s shared default account for a service. Team members use it when the agent’s account setting is Use Team Default.

​
Admin setup

Some services require an administrator to authorize Orchestrivo before anyone on the team can connect their own account.

​
Microsoft Office setup (admin only)

For organizations using Microsoft services (Teams, Outlook, Excel, Word, OneLake), administrators must configure consent in Microsoft Entra ID before users can authenticate.
Start by connecting a Microsoft connector in Orchestrivo yourself. Orchestrivo only appears in your tenant once someone attempts to authenticate, so do this first or you won’t find the app in the steps below.
1

Access Microsoft Entra admin center

Go to Microsoft Entra admin center
2

Navigate to Enterprise apps

Navigate to Entra ID > Enterprise apps > All applications
3

Search for Orchestrivo

Search for Orchestrivo using client ID: d3c2a9a5-7f60-40d1-a8ba-62bab546a0f3
4

Grant consent

Under Security > Permissions, click Grant admin consent, then complete the sign-in prompt and click Accept.
5

Verify the permissions landed

Still under Security > Permissions, open the Admin consent tab. You should see a row for each permission listed in Required Permissions by Service.If the tab is empty or unchanged, the request failed and nothing was granted. Use the Direct Consent Link tab above instead.

​
Required permissions by service

Every permission below is delegated. Orchestrivo acts only as the signed-in user and can never do more than that user could do themselves. There are no application (app-only) permissions, so Orchestrivo has no standalone background access to other people’s mailboxes, files, or sites. Each service also requires offline_access, which lets Orchestrivo refresh its access token without asking users to sign in each time it expires. Expand a service to see the permissions it needs and the consent link that grants them. Only grant the services you actually plan to use.
Grant Teams permissions →
Grant Outlook permissions →
Grant Outlook Calendar permissions →
Grant Excel and Word permissions →
Grant SharePoint permissions →
Grant OneDrive permissions →
OneLake needs its own consent link and is not covered by the other services.Grant OneLake permissions →
Azure needs two separate consent links. Open both.Grant Azure resource management permissions →Grant Azure AI permissions →
Admin required: You must be a Global Administrator, Cloud Application Administrator, or Application Administrator to grant consent.
Confirm it worked with a non-admin account. An administrator can succeed for reasons that don’t apply to everyone else. After granting consent, have a regular user connect the service in Orchestrivo. If they get through without an approval prompt, the tenant is set up correctly.

​
Salesforce setup (Admin only)

As of September 2025, Salesforce introduced new security restrictions that require administrators to pre-install the Orchestrivo connected app before users can authenticate with their Salesforce instances. For more details, see the official Salesforce documentation.
Orchestrivo is a Salesforce Connected App, not an AppExchange app. It’s not listed in the Salesforce AppExchange marketplace. A Salesforce administrator needs to authorize the connection directly.
The easiest way is for a Salesforce administrator to authenticate directly from Orchestrivo:
1

Go to your Connectors page

Visit the Salesforce connectors page in Orchestrivo
2

Click Connect and authorize

Click Connect next to Salesforce and sign in with your Salesforce admin account.
3

Orchestrivo is automatically added

The Orchestrivo connected app is automatically installed in your Salesforce organization. No additional setup needed.
After the admin connects, all users in the Salesforce organization can authenticate their own accounts with Orchestrivo.

​
Managing the connected app in Salesforce

  1. Go to Setup > Apps > Connected Apps > Manage Connected Apps
  2. Find the Orchestrivo app to view or modify settings
  3. Configure user access policies, IP restrictions, and session policies as needed
For more details, refer to the Salesforce Connected App documentation.

​
Security & compliance

SOC 2 Type II

Certified secure infrastructure and processes

GDPR compliant

Full compliance with data protection regulations

Trust Center

View the complete security documentation

Organization and teams

Understand how personal spaces and teams work

User roles & permissions

Organization and team permission levels