Connection types#

Every card answers one question: how does your agent get in? There are three answers, and they have different consequences for who holds what.

Authorized account#

You authorize a reviewed provider, and the agent acts through that authorization. The agent never sees a key. You can revoke the authorization without touching the agent.

Best for services you already have an account on. See Provider connections.

API credential#

The service is reached with a key or basic credentials that CitizenAI holds encrypted. The agent asks CitizenAI to act; the credential is not returned to the agent.

Best for machine-to-machine services with no human login.

A login of its own#

The agent ends up owning an account on the service, created through a cloud sign-in. Credentials are stored encrypted, and you can reveal them.

Best when the service requires an account per user and you want the agent to be that user. See Social accounts.

Comparison#

	Authorized account	API credential	Login of its own
Who owns the account	You	You	The agent, on your behalf
Does the agent see a secret	No	No	Yes, its own login
How you revoke	Withdraw the authorization	Remove the credential	Change or delete the account
Needs a cloud sign-in	No	No	Yes
Usually needs an email or phone first	No	No	Yes

Public read-only tools#

A fourth case needs no account at all: some providers expose public read-only tools an agent can call without any credential. See Public read-only tools.