OAuth sign-in

For many hosted connectors you don’t paste a key at all — you sign in once on the vendor’s own website, and the connection stays live on its own.

What you’ll learn

• How OAuth sign-in differs from pasting an API key.
• How to connect a service like Slack or Google Workspace.
• Why you sign in once and don’t have to re-authenticate.

Sign in, don’t paste

With OAuth 2.1, you authorize askTheodor on the provider’s website instead of handling a raw key. The vendor checks your password; askTheodor only ever receives a token. Your credentials never pass through the chat.

Connect a service

1. From the remote connector directory, pick a service that supports sign-in — Slack, Google Workspace, or DocuSign, among others.
2. Choose Sign in with…; the vendor’s own login page opens in your browser.
3. Approve the access. askTheodor stores only a refresh token — and tokens auto-refresh, so the connection keeps working without you signing in again.

Manage the link

A linked connector shows a 🔐 OAuth badge, and Unlink removes it whenever you want to revoke access.

Sign in once

Because the stored refresh token renews itself, a single sign-in keeps the connector live indefinitely — you won’t be prompted to re-authenticate each session.

Prefer OAuth when offered

If a service offers sign-in, use it over an API key — you never handle the raw secret, and the vendor stays in charge of your password.

What connecting your inbox actually gets you

This is the connector people want most and worry about most, so it’s worth being precise about both halves.

Triage without send. A worker can read incoming mail, classify it, and prepare replies — and inbound messages produce drafts, not sends. You wake up to a queue of prepared responses, each one a decision rather than a task. The reading is delegated; the sending never is.

Answers grounded in what was actually said. “What did we agree with this client about the delivery date?” becomes answerable from the thread itself, rather than from your memory of a conversation six weeks ago. Pair it with the Library and a worker can reconcile the email trail against the signed document.

Calendar-aware preparation. With Workspace connected, “what am I walking into tomorrow, and what do I need to know about each of them?” becomes a Routine you read with coffee rather than a scramble at 8:55.

Grant the narrowest scope offered

At the vendor’s consent screen, read what you’re approving and pick the least you can live with — read-only where it’s offered. And remember the two controls are independent: OAuth decides what askTheodor could reach, the worker’s allowlist decides which worker can reach it. Connect at the account level, grant at the worker level.

Recap

OAuth sign-in lets you authorize Slack, Google Workspace, DocuSign, and more on the vendor’s site, with askTheodor holding only an auto-refreshing token — sign in once, stay connected. Next: choose the brains behind all this work.

📖 Reference in the docs: Connectors · Channels

➡️ Next: Providers & models