Connectors Setup & Credentials Reference

Aigenzey Cowork connects directly to your external apps and data sources on your behalf. Whether you are an individual personal user or managing an enterprise organization, Cowork provides secure, seamless integrations.

Personal Accounts: Instant 1-Click Connect

For individual productivity users, connecting external tools is completely friction-free:

1. Prompt-Driven Just-In-Time Connect: Ask the agent to do something involving an external service (e.g. "Check my upcoming meetings on Google Calendar" or "Draft an email to Alex in Gmail").
2. 1-Click Authorization: The agent immediately presents a Connect button in the chat. Clicking it opens the provider's standard OAuth consent dialog.
3. Immediate Execution: Once authorized, the agent automatically executes your requested action. You only need to authorize each service once.

You can also manage or disconnect your personal accounts at any time from the Connections tab in the Cowork sidebar.

Business & Enterprise: Custom Corporate App Overrides

While Business workspaces can use platform-managed connections by default, enterprise IT and security compliance policies often require authentications to route through internally owned developer applications (e.g. your company's own Google Cloud Project or Microsoft Entra ID Enterprise App registration).

Organization Administrators can configure custom app credentials and govern connector policies for their entire team from the Admin Panel → Connectors tab.

Enterprise OAuth Scope Standards

Aigenzey Cowork adheres to strict enterprise least-privilege connector standards:

• Principle of Least Privilege: Scopes are strictly limited to the minimum permissions required for agent discovery, reading, and necessary actions (e.g. Gmail scopes deliberately exclude permanent mailbox deletion; Slack scopes use granular MCP container search rather than legacy broad access).
• Native Access Control Lists (ACLs): The agent inherits the exact permissions and role boundaries of the authenticated user. If a user cannot access a document or ticket in the provider's native UI, the agent cannot access it either.
• Federated Real-Time Execution: Rather than dumping bulk data into unmanaged storage, Cowork queries external APIs in real-time under user session context.

Security & Token Isolation

Aigenzey Cowork implements strict individual user scoping for all authentication tokens:

• User-Level Scoping Key: Every authenticated token is keyed by user_id + organization_id in the connector_tokens repository.
• Zero Cross-User Sharing: Even for enterprise platforms like Salesforce, HubSpot, NetSuite, or Workday, tokens are strictly private to the user who authorized them. User A cannot view, borrow, or execute actions with credentials authorized by User B.
• Fernet Token Encryption: Tokens are encrypted at rest with AES-128-CBC and HMAC-SHA256 authenticated encryption using TOKEN_ENCRYPTION_KEY.
• Anti-CSRF Signed State: All OAuth redirect flows carry cryptographic signatures generated using OAUTH_STATE_SECRET, binding the redirect hop to the originating user and organization session.
• Automatic Refresh: When an access token nears expiration, the orchestrator transparently uses the stored refresh token to obtain fresh credentials before executing the tool call.

Business Admin Panel Overrides

From the Admin Panel → Connectors section, Organization Administrators have full control over connector behavior:

1. Substitute Custom Corporate OAuth Credentials: Supply your organization's custom CLIENT_ID, CLIENT_SECRET, and tenant/subdomain values so all employee authorizations route through your own verified enterprise apps.
2. Disable Unapproved Connectors: Hide specific connectors from your organization's catalog. Disabling a connector prevents employees from connecting that service while preserving existing tokens in case it is re-enabled later.

Authorized Redirect URIs (Business & Enterprise)

When registering custom enterprise OAuth applications in provider developer portals (e.g. Google Cloud Console, Microsoft Entra ID / Azure AD, Atlassian, Salesforce, Slack), configure the Authorized Redirect URI with the Aigenzey Cowork domain (https://cowork.aigenzey.com):

Enterprise Provider Matrix & Required OAuth Scopes

Below is the complete reference matrix of supported first-party connectors, their exact connector slugs for the redirect URI, required credential keys, and exact OAuth scope strings.

1. Google Workspace

Configure in Google Cloud Console → APIs & Services → Credentials → OAuth 2.0 Client IDs. Enable the corresponding Google APIs in the API Library.

2. Microsoft 365 & Microsoft Graph

Register in Microsoft Entra ID (Azure AD) → App registrations. Add Microsoft Graph Delegated permissions.

3. Development & Project Management

4. CRM, Revenue & Customer Support

5. ERP, HR & Enterprise ITSM

6. Zoho Enterprise Suite

All Zoho services include AaaServer.profile.READ to resolve the user's identity, plus service-specific read/write scopes.

7. Social Media Platforms

Custom Connectors & MCP Servers (Business & Enterprise)

In addition to built-in providers, users and administrators can dynamically register custom integrations by clicking New custom connector on the Connections screen.

1. Custom Model Context Protocol (MCP) Servers

Connects to any remote MCP server over Server-Sent Events (SSE) or streamable HTTP. The agent dynamically fetches tool declarations from the MCP server at runtime.

• Endpoint URL: The SSE / HTTP stream URL of the MCP server (e.g. https://mcp.internal.company.com/sse).
• Authentication Types (auth_type):
  • headers: Static secret headers (e.g. Authorization: Bearer <token> or X-API-Key).
  • oauth2: Full dynamic OAuth 2.0 authorization-code flow against your custom OAuth provider. Redirects land on the shared https://cowork.aigenzey.com/auth/custommcp/callback route.
  • none: Unauthenticated local or internal endpoints.

2. Custom OpenAPI & REST Services

• OpenAPI Specification: Provide a public or authenticated OpenAPI 3.0/3.1 JSON/YAML URL. Cowork inspects endpoints, parameters, and schemas to generate callable agent tools.
• REST API / Simple HTTP: Configure custom base URLs, HTTP methods (GET, POST, PUT, DELETE), header templates, and JSON request bodies for internal microservices.

Database & Data Sources (Business & Enterprise)

Connect relational databases and search clusters to allow Cowork to run read-only queries, generate analytic charts, and reconcile financial figures:

• Supported Engines: PostgreSQL, MySQL, MongoDB, Elasticsearch, Redis, ClickHouse, Snowflake, and Oracle.
• Integration Method: Added as Custom MCP database endpoints or secure read-only SQL wrappers with parameter sanitization.
• Mandatory Connection Testing: To prevent runtime failures in agent tasks, a connection test must succeed before any custom connector or database configuration can be saved. The backend executes a stateless live probe against the credentials; saving remains disabled if last_test_ok is false.