Accounts: your sign-ins with other services

Settings → Integrations, expand an integration’s row

An account is your securely stored sign-in with an external service: your Asana account, your Microsoft 365 mailbox or an API key for your CRM. Once stored, the AI can use the service for you in every chat, for example through integrations or connected skills.

Where to find your accounts

Under Settings → Integrations every integration has a row of its own, together with where you stand with it, for example “Connected as anna.maier@company.com”. Click a row to expand it. Under “Stored accounts” you see your own accounts for this integration and the ones others have shared with you.

If you connect an interface in the chat, it becomes an integration of its own in this list, with your account on it. It belongs to you and can be shared like any other. If someone shared an account with you, its integration is in your list, even if the integration is not shared with you. An account of your own on an integration that is no longer shared with you shows up as a row of its own.

Rows that need something from you are at the top. As long as there are such rows, the Integrations menu item in the settings shows a small counter badge.

Personal account and company account

Every account has exactly one owner, a person or the company:

Personal account: It is yours. Only you sign in with it again, replace its key, share it or hand it over.
Company account: It belongs to the company, for example the company’s Lexware key or a team mailbox. It stays when the person who set it up leaves the company. Administrators and the owner of the integration create it, maintain it and share it. A company account can be used by whoever it is shared with, like any other account; the integration being shared with someone is not enough on its own.

A company account with a sign-in at the provider, such as a team mailbox, has one sign-in for everyone: whoever uses it works in that mailbox, not in their own. It can also be the basis of a data source: when you set up a Microsoft 365 data source, pick it by its “Company account” label, even if you have a Microsoft account of your own.

How an account is added

You don’t have to create accounts separately; they appear where you need them:

Right from the row: If an integration shows “Connect”, “Sign in” or “Add key”, click it. For services with a sign-in (for example Microsoft 365, Google or Asana) the provider’s sign-in window opens; allow pop-ups for it. For a key a small dialog opens. Afterwards 9brains checks the account automatically and the row shows the new state.
Another account: In the expanded row, “Add account” or “Add another account” adds a further account, for example a second Microsoft 365 mailbox.
As a company account: If you are an administrator or the owner of the integration, 9brains first asks “Belongs to: Me / The company” when you connect. With “The company” the new account becomes a company account. It starts out shared with all members to use, and right afterwards you decide who exactly gets it. An account that is already yours becomes a company account through “Hand over → To the company”, without entering the credentials again.
In the chat: When the AI needs credentials for a task, it shows a secure input field right in the chat. Whatever you enter there is stored encrypted and never appears in the chat history.
Through an assignment: An administrator can assign an integration to you. You then connect with your own account.

When you sign in through the provider, your password never reaches 9brains. An account applies to the integration you signed in at, even if a second integration connects the same service.

Security principle: write once, never read back

Stored credentials cannot be displayed again by anyone, not even by yourself or by administrators. There are only two actions: replace them with new values or delete the account. They are used exclusively and automatically when the AI calls the respective service, and only for exactly that service.

What the row tells you

Every row shows where you stand with this integration and at most one button, the one that helps right now:

Display	Meaning	Button
Connected as …	Your own account works
Via account of …	A colleague shared their own account with you; with “· awaiting confirmation” added it is paused until that person confirms it	Connect your own account, if the integration is shared with you
Via company account	You work with this integration’s company account; with the addition “· awaiting confirmation” it is paused until an administrator or the owner of the integration confirms it
No account needed	The integration works without a sign-in
Assigned · no account yet	An administrator assigned the integration to you	Connect
No account yet	You have no account here yet	Connect
Not signed in	The sign-in with the provider is missing	Sign in
No key stored	No key has been entered yet	Add key
Last check failed	The service no longer accepts your credentials	Sign in again or Replace key
Waiting for your confirmation	The integration’s address, connector or sign-in app was changed; your account is paused until you confirm it. You see the new address before you do, also before signing in again. If the integration moves to another server, the sign-in of whoever changed it is paused too	Sign in again (sign-in) or Confirm (key)
Sign-in not set up yet	Whoever owns or administers the integration has to set up the sign-in with the provider first
Switched off	The integration is switched off and not available to the AI
Not in use	The integration is not shared with you; your account stays but is not used anywhere

Connected means checked

“Connected” only shows when the last check succeeded, so access demonstrably works. All accounts are also checked automatically every day. If a service no longer accepts the credentials (for example after a key rotation on the provider’s side), the row switches to “Last check failed” on its own.

An account waiting for your confirmation is not used anywhere by 9brains, not even for the daily check, until you have confirmed or signed in again. That way your credentials never go to an address somebody else entered.

Actions on an account

In the expanded row, every account under “Stored accounts” offers these actions:

Test: Checks whether access to the service works. The result appears right away.
Sign in again: Restarts the sign-in with the provider, for example when it has expired or you want to use a different account.
Replace key: Opens the secure input field to store a new key.
Share: Grants the account to colleagues or agents, see Sharing. Agents have a block of their own below the list.
Hand over: Passes your account on to another person in your company, see Handing over an account.
Use as default: Only shown when you hold several accounts of your own at this integration. Makes this account your default account; it is marked “Default”.
History: Shows when the account was created, used, checked or changed. The credentials themselves never appear there.
Delete: Removes the account and its credentials permanently. Whatever worked with it only works again once a new account is stored.

Accounts others have shared with you can be used and tested, but not changed. The account shows the role it is shared with you in, for example “Shared with you: Use”. A company account is maintained only by administrators and the owner of the integration.

Several accounts with one provider

For services with a sign-in through the provider (for example Microsoft 365) there is nothing to type in, and the sign-in is renewed automatically. Every account shows which address it is signed in with. You can store several accounts of the same provider, for example your personal mailbox and a team mailbox. When you sign in, the provider asks every time which account is meant, even when you are already signed in in the same browser. For a second mailbox, pick “Use another account” there.

An account applies only in the workspace where you signed it in. If you work in several workspaces, you sign in in each of them. If you hold several accounts at one integration, which one is meant is never guessed: 9brains uses your default account.

Some accounts cover an entire provider, others cover exactly one of its services. If you have connected both Google Workspace and Google Ads, for example, Google Ads uses the account made specifically for it. That way every request reaches the account it was meant for.

Your own app with the provider: For services without a prepared sign-in (for example banks or company-owned apps), a client ID and optionally a client secret of your own app are needed once. You must enter the redirect URI shown in that app at the provider, otherwise the sign-in fails. Like all credentials, the client secret cannot be viewed again after saving.

Which account the AI uses

If several accounts come into question at one integration, 9brains takes your own first, then one shared with you, and the company account last.

If you hold several accounts of your own at one integration, the AI uses your default account. Your first account there is the default automatically. You make another one the default with “Use as default”. If your default account cannot be used at the moment, no other account steps in; you fix it or name another one explicitly. If you delete or hand over your default account, your oldest remaining account at this integration takes its place.

A team mailbox attached as a company account to the same integration as your own mailbox is therefore only used by you as long as you have no account of your own there. If it should run alongside your own, an administrator sets up a separate integration for it.

By default an account is personal: nobody but you can use it. With “Share” you change that deliberately:

People and groups: They then work with your account, a common team access. Their row reads “Via account of” with your name. Only the person the account belongs to can sign in again. They do not need the integration to be shared with them for this: as long as you share your account with them, the integration is in their overview and works with your account. They can only connect an account of their own there once the integration is shared with them. With the entry “All members” you share your account with the whole workspace.
Agents: To let an agent use your account, give it to the agent in the block “Agents using this account” below the list. From then on it works with it like a colleague with a keyring of their own, in chat exactly as in runs on a schedule or via webhook, and for everyone who may use the agent.

When you open the picker “Add a group or person” it immediately shows the existing groups and people, grouped by kind. You only need to type if you want to narrow the list down; anyone who already has access is greyed out and marked “Already granted”.

Agents on an account

The agents working with the account are folded under “Agents using this account” with their number. Unfolded, each agent has one row with its name and the person who added it. If there are more than eight, the search field above them finds one.

“Add agent” at the end of the block lets you pick one of the agents you may edit. You are then asked a question that names who is allowed to use this agent and points out that the agent also works without you, including on a schedule. The agent only gets the access once you agree, and the agreement is recorded together with its time and the audience. Details under Contributing an account.

“Remove” takes the account away from an agent after a confirmation. The agent then keeps working without this account, including in runs on a schedule or via webhook.

You can only share your own accounts further. An account somebody shared with you can only be passed on to agents and your data sources if it is shared with you in the role Use and pass on. This works for every agent you may edit, on its Tools & accounts tab.

Administrators and the owner of the integration share a company account, with the same list and the same roles. You do not add agents there: a company account reaches an agent or a data source through a person it is shared with as Use and pass on. To give it to an agent yourself, add yourself to the list. Which agents got it that way you see in the block “Agents using this account”, where you can also remove them.

Someone the integration is newly shared with can connect an account of their own there. They only use the company account once it is shared with them.

An agent marked “Not confirmed” with a “Confirm” button is left over from an earlier version: the agent does not use the account. Use “Confirm” to supply the agreement, or remove the entry.

Important: Sharing always means others work with your account. If each person should use their own account, an assignment by an administrator is the right way. If the account should belong to the company and stay when you leave, a company account is the right way.

If an app depends on this account, that is stated above the access list, with the app’s name. The reason: an app you built in the chat on an interface you connected yourself uses this one account, for everybody who opens the app. Until you share it, the app runs for you alone, and your colleagues are told when they open it to ask you to share the account with them.

Apps allowed to use the account are listed on its card below the agents, folded under “Apps using this account” with their number. Unfolded, each app has one row with the number of people who allowed it, for example “3 people, including you” or “only you”. Clicking it shows those people with the day they allowed it, you first. Everyone allows this themselves the first time they open the app (Allowing accounts), and the app uses the account for that person only. “Withdraw” next to a person takes their allowance back; if it was the last account allowed, the app asks again the next time it is opened. On your own accounts and on company accounts you look after, you see everybody’s allowances and can withdraw each of them. If several people allowed an app, “Withdraw for everyone” takes them all back at once after a confirmation; everyone then has to allow it again the next time they use the app. On an account somebody shares with you, you only see your own.

Use or use and pass on

Every person and group in the list gets a role. Whoever is added starts with Use.

Use: They work with your account themselves, in the chat, in apps they open, and with an agent while they are using it.
Use and pass on: They may also give your account to every agent they may edit and to their own data sources. These then use it for everyone who uses them, including automatic runs. If they give it to an agent others use as well, they see beforehand who that is, just like you.

If you set the role back to Use or remove the person, their agents and data sources lose your account immediately.

In no role can anybody else view, change, share further, hand over or delete your account. If you set an account up for somebody else, you therefore do not share it, you hand it over.

Handing over an account

You can hand an account of your own over to another person in your company, whatever the kind of sign-in. The typical case: you set up an account for a colleague who can’t manage it on their own, test it and hand it over. Making sure it really is their account, their mailbox for example, is your responsibility.

Under Settings → Integrations, expand the integration’s row
Pick “Hand over” on the account
Pick the person and confirm

From then on the account belongs to the other person, and you no longer have any access to it, not even to use it, unless it is shared with a group you belong to. Whoever had the account shared with them keeps using it. Agents of the other person keep working with it; on every other agent it rests until they confirm it there. Data sources that do not belong to them stop syncing, their content stays. The person gets no notification: the account simply shows up in their overview under Settings → Integrations. It is only used for them if the integration is shared with them.

You can only hand over personal accounts. A company account is not handed over again.

Handing over to the company

If you are an administrator or the owner of the integration, “To the company” appears next to the person search when you hand over. Your account then becomes a company account without anyone entering the credentials again. Everyone it is shared with keeps it in their role, and agents and data sources keep working with it. You yourself stay on the list with Use and pass on, so your own agents and data sources keep running too. From then on all administrators and the owner of the integration maintain and share it.

Assigned integrations

Administrators can assign an integration to you. Assigning is a tick box on the sharing of the integration on its Access tab: it is shared with you, and you are expected to connect your own account. Nobody else’s credentials are ever handed out. After signing in, a prompt reminds you of open assignments, and the row under Settings → Integrations sits at the top reading “Assigned · no account yet”. With “Connect” you sign in with your own account or store your key, right on the assigned integration. Where the service runs on a system of your company, such as DocuWare or a Shopify shop, the integration brings the address and the app; you only sign in with your account.

If you already work through an account shared with you or the company account, the assignment counts as done. Sharing without an assignment does not remind you.

For administrators: the Accounts area

Administrators find the workspace-wide overview under Settings → Administration → Accounts, split into two areas.

Inventory

All accounts in the workspace with owner, service, status, sharing and last use. The key figures at the top of the page double as filters, complemented by search plus status and sharing filters.

Even administrators never see the stored credentials. A person’s account can only be changed, given new credentials, shared or handed over by that person; administrators can test and revoke it. Revoke deletes an account permanently including its credentials. When somebody leaves the company, their personal accounts are deleted when you remove the person, unless you hand individual ones over to somebody else first. Company accounts stay.

Company accounts

You do not create company accounts here but when connecting the integration concerned, with “Belongs to: The company”, for example for a key that applies to everyone or a team mailbox. An existing account of your own becomes a company account through “Hand over → To the company”. Company accounts are maintained at the integration: replace the key, sign in again, share, delete. The owner of the integration may do the same.

Assignments: one service, own account per person

With an assignment you roll out an integration to your team without handing out credentials. Assigning is the “Assign” tick box on an entry of an integration’s sharing on its Access tab; the “Assignments” tab shows every assignment of the workspace in one place:

Click “New assignment” and pick the integration. Where a service exists more than once, such as two Shopify shops, pick the right integration
Pick the groups or people who should use it. The integration is shared with them as well
Each assigned person is reminded after signing in and connects their own account to exactly this integration

You see the progress per assignment (for example “3 / 8 connected”). Working through a shared account or the company account counts as connected as well. The integration’s sharing on its Access tab shows the same assignments and where each person stands, to its owner and the administrators only. An assignment can be withdrawn; the sharing and accounts already stored are kept.