Connect methods
How each integration in the Integrations Hub connects: your own credentials, a sandbox account through Kinective, or UDG. Covers credential models and sandbox versus production.
Use this page with Integrations Hub.
Browse categories:
Connect BYOK (Bring Your Own Key)
Used by: most integrations in the catalog, such as Salesforce, HubSpot, Stripe, Google Workspace, Microsoft 365, Slack, and Twilio.
You supply credentials for your own account with the provider — an API key, an OAuth client ID and secret, or a webhook signing secret. The platform stores them encrypted and uses them at runtime. Some integrations also offer Use Platform Managed Keys, so you connect without entering credentials. See Choose a credential model.
How it works
Open Integrations and find the integration in the catalog.
Select Connect on its card.
Enter the credentials the integration asks for:
Token-based integrations: paste your API key.
OAuth integrations, such as Salesforce or Google Workspace: start the OAuth flow. The platform redirects you to the provider's consent screen, then stores the access and refresh tokens.
Token and webhook integrations, such as Stripe: enter your API key and webhook signing secret.
The platform validates and encrypts your credentials.
The connection is available to agents and apps, in the builders the integration supports.
Credential security
Credentials are encrypted before storage. Fields marked as credential fields are never stored in plaintext.
When you view a configured integration, credential values display as
******.For OAuth integrations, the platform handles token refresh.
Choose a credential model
An integration's connect form can offer up to three ways to hold its credentials.
Shared credentials
One set of credentials you enter, used for every run.
The default connect form.
Use per-user credentials (ONE-WAY)
Each user provides their own credentials at runtime, held in their own vault.
Offered only where the integration supports it.
Use Platform Managed Keys (RECOMMENDED)
The platform handles credentials and security, so you connect without any setup.
Offered only where the integration supports it.
Per-user credentials can't be undone
Choosing Use per-user credentials shows a warning: "This setting cannot be undone. Once enabled, you cannot revert to a shared credential model. Every user will need to individually authenticate their own credentials."
To save it, tick I understand this is permanent — I cannot revert to a shared credential model after saving. A Confirm irreversible change dialog follows; select Yes, enable per-user vault, or Go back. Once a connection is saved, the per-user option can't be selected for it.
How does per-user credential work?, under the option, describes the flow:
Vault provisioned—a credential vault is created for each individual user, separate from any shared integration-level vault.
User registers credentials—each user authenticates once, through OAuth, an API key, or a token, stored in their own vault entry.
Session references the vault—when an agent session starts, it looks up that user's vault, so no credential is passed on every call.
Runtime resolution—the platform resolves the correct credential automatically, including after rotations or expirations, without restarting the session.
Isolation enforced—no user's session can read or use another user's credential.
Sandbox and production
Some integrations connect to a sandbox environment for testing.
Sandbox only — the integration connects with Connect sandbox account: "Test this integration using sandbox credentials." The core banking integrations work this way.
Sandbox or production — the form shows Connect sandbox account (Available) and Production access ("Enable live production access", marked Contact sales). Integrations that work this way include Bill.com, Creditsafe, doola, eBay, Finicity, FreeAgent, Invoiced, Paysafe, QuickBooks, Redtail CRM, and Square.
The category pages mark each integration's connection as sandbox only, or sandbox with production on request.
Sandbox account (core banking through Kinective)
Used by: the 20 core banking integrations reached through Kinective.
These integrations are available in Agent Builder only. They connect with a sandbox account and use Platform Managed Keys, so there are no credentials to enter. Earlier versions of this guide called this method MCP Sandbox Account.
Fiserv: DNA, Portico, Precision, Premier, Signature, Spectrum, XP2
FIS: Bankway, Horizon, IBS, Miser
Jack Henry: CIF 20/20, Core Director, Silverlake, Symitar, Symitar EASE
Other: COCC (DNA) - Insight, Corelation - Keystone, CSI - NuPoint, Finastra - Phoenix
Connect via UDG
Used by: 82 integrations across banking, CRM, commerce, customer support, compliance, analytics, and productivity, such as ActiveCampaign, Pipedrive, Shopify, DocuSign, ServiceNow, and Zendesk.
UDG is a managed partner network that brokers connections to providers the platform doesn't connect to directly.
Not yet available. UDG integrations are listed in the catalog and counted under Available, but their Connect via UDG button is disabled. You can't connect one yet.
Compare the connect methods
Credentials
Shared, per-user, or Platform Managed Keys, depending on the integration
Platform Managed Keys
—
Builders
App Builder, Agent Builder, or both, depending on the integration
Agent Builder
—
Can connect today
Yes
Yes, sandbox only
No
Integrations
106
20
82
A further 20 integrations show Coming Soon and can't be connected yet.
Maintained by Abhishek Paul
AI-assisted, human-approved
Last updated
Was this helpful?