Connections: credentials for external services
Settings → Security, section “Credentials”
A connection is a securely stored access to an external service: an API key, a username with password, or an OAuth sign-in (for example Microsoft or Google). Once stored, the AI can use the service for you in every chat, for example through connected skills or skill templates.
How connections are created
Section titled “How connections are created”You don’t have to create connections manually; they appear where you need them:
- When activating a template (the standard way): If you pick a template under Settings → System integrations (for example Microsoft 365 or DHL Tracking), the credentials dialog or the provider sign-in opens right away.
- In the chat: When the AI needs credentials for a task, it shows a secure input field right in the chat. Whatever you enter there is stored encrypted and never appears in the chat history.
- Via OAuth: For services like Microsoft 365 or Google Workspace you sign in with the provider directly in a popup. Your password never reaches 9brains.
- Through an assignment: An administrator can assign a service to you. The connection then appears under “Action required” and you connect with your own credentials.
Security principle: write once, never read back
Section titled “Security principle: write once, never read back”Stored credentials cannot be displayed again by anyone, not even by yourself or by administrators. There are only two actions: replace them with new values or delete them. They are used exclusively and automatically when the AI calls the respective service, and only for exactly that service.
Your connections at a glance
Section titled “Your connections at a glance”Under Settings → Security you find the “Credentials” section. The list is organized in three groups:
- Action required: Connections that still need something from you, for example assigned services you have not connected yet, or connections without stored values.
- My connections: All connections you own.
- Shared with me: Connections others have shared with you. You can use and test them, but not change them.
As long as something sits in “Action required”, the Security menu item in the settings shows a small counter badge. It disappears as soon as you have taken care of the open items.
Status: Connected means verified
Section titled “Status: Connected means verified”Every connection shows its current state:
| Status | Meaning |
|---|---|
| Connected (green) | The last test succeeded; access is proven to work |
| OAuth active | The provider sign-in is in place and renewed automatically |
| Unverified (grey) | Credentials are stored but not yet tested successfully |
| Error (red) | The last test failed; the service no longer accepts the credentials |
| No credentials | No values have been stored yet |
All connections with stored credentials are also re-checked automatically every day. If a service stops accepting the values (for example after a key rotation on the provider side), the status flips to “Error” on its own, without you having to test.
Detail view and actions
Section titled “Detail view and actions”Click a connection to open the detail view. It is organized in three areas: Credentials, Access and Activity.
- Test: Checks with the stored credentials whether access to the service works. The result appears immediately and updates the status.
- Set credentials / Re-enter: Opens the secure input field to store the values for the first time or to renew them (for example after a key rotation).
- Reconnect (OAuth only): Restarts the provider sign-in, for example when the connection has expired or you want to use a different account.
- Activity: Shows the connection’s recent events; the full audit log lists when it was created, used, tested or changed. The credentials themselves never appear there.
- Delete: Removes the connection and the stored credentials permanently. Skills using this connection stop working until new credentials are stored.
OAuth connections
Section titled “OAuth connections”For OAuth services (for example Microsoft 365) there is nothing to type in: the sign-in runs through the provider and is renewed automatically. The connection shows which account it is connected with. You can also connect several accounts of the same provider, for example your personal mailbox and a team mailbox; the displayed account keeps them apart.
Your own OAuth app: For services without a preconfigured sign-in (for example banks or company-owned OAuth apps), you store the client ID and optionally the client secret of your own OAuth app in the detail view. You must register the redirect URI shown there in the service’s OAuth app, otherwise the sign-in fails. Like all credentials, the client secret cannot be viewed again after saving.
Sharing: access for colleagues and agents
Section titled “Sharing: access for colleagues and agents”By default a connection is personal: nobody but you can use the credentials. You change that deliberately in the Access area of the detail view:
- “Share connection”: Pick groups or people. They then use your stored credentials, a common team access. For the recipients the connection appears under “Shared with me”; they can neither view nor change it.
- Granting agents access: Agents that run autonomously (on a schedule or via webhook) may only use your credentials with an explicit grant. You give that grant here too, in the same picker.
Important: Sharing always means others work with your credentials. If each person should use their own credentials, an assignment by an administrator is the right way.
Assigned connections
Section titled “Assigned connections”Administrators can assign a service to you. Only the description of what to connect is distributed, never anyone else’s credentials. After signing in, a prompt reminds you of open assignments, and they appear in the “Credentials” section under “Action required”. With “Connect now” you store your own credentials or sign in with the provider. After that, the service is ready for you.
For administrators: Credential Management
Section titled “For administrators: Credential Management”Administrators find the workspace-wide overview under Settings → Administration → Credential Management, split into two areas.
Inventory
Section titled “Inventory”All connections in the workspace with owner, service, status, sharing and last use. The key figures at the top of the page (total connections, shared, without credentials, unused for a while) double as filters, complemented by search plus status and sharing filters.
Even administrators never see the stored values; what is managed are properties, sharing and lifecycle. Connections can be revoked here (deleted permanently, including credentials), for example when an employee leaves the company.
Assignments: one service, own credentials per person
Section titled “Assignments: one service, own credentials per person”With an assignment you roll out a service to your team without handing out credentials:
- In the “Assignments” tab, click “New assignment” and pick the service
- Pick the groups or people who should use it
- Each assigned person is reminded after signing in and connects with their own credentials
You see the progress per assignment (for example “3 / 8 connected”). An assignment can be withdrawn; credentials users have already stored are kept.