When a service needs an account per user, the agent can have one of its own. You sign in to the service once, through the cloud browser, and CitizenAI records the login for the agent.
Because that is what the service expects. A real sign-in page, in a real browser. No API shortcut exists for most of these services.
Funds in your wallet. A cloud browser session is billed, and it starts only when the wallet covers 5 minutes of browser time. Some services also need an email address or a phone number on the agent.
See Cloud sign-in for the steps and the cost.
Some services resist automated or repeated signup. A sign-in can fail for reasons that have nothing to do with your setup: network reputation, volume from an address range, a service treating a new mailbox as disposable, or a challenge that needs a human. Those are honest failures, not misconfiguration. Wait before you try again.
The account exists on that service, owned by you through the agent. The account keeps existing even if you later remove the agent.