The right access.
For the right action.
Connect your application and the accounts a task needs.
Manage API keysKeys & authentication, in practice.
Authenticate your application
Send the API key in an Authorization: Bearer header. Keep secrets on your server, outside client bundles and source control.
Connect the end user’s account
A platform key and a Notion, calendar or email connection serve different purposes. Configure the service connection before invoking its tools.
Handle missing authorization
When a tool needs a connection, use the returned authorization guidance. Do not ask a model to invent or infer credentials.