Apps and capabilities

Use delegated sign-in for GitHub, Slack, Jira, Linear, Notion, Figma, GitLab, Bitbucket, and Vercel when available. Codelit receives scoped tokens and shows the connected identity so the user knows which account a team will use.

Select an Agent card, choose its module and provider-specific role, then choose the connected account, resource, and bounded behavior. Codelit offers the repositories, projects, pages, teams, files, or channels that account can use. Use Test read for a connected app or Check setup for a native provider operation before Live run; the same choice becomes the default in the run brief.

• Slack offers the connected bot and only channels it has joined and can read. Invite the bot to another channel, then use Refresh connected resources.
• GitHub, Jira, Linear, and Vercel actions populate issue, branch, assignee, transition, state, and deployment choices when the provider supplies them. Microsoft Teams operations populate the exact OAuth-scoped Team and channel.
• If the provider no longer returns a saved resource, Codelit marks it Saved unavailable and blocks the design-time check until you deliberately choose a replacement or reconnect. It never falls back to the first result.
• Resource IDs come from provider discovery and are never pasted into the common setup path.
• Optional action tuning stays under Optional action fields; credentials remain in the encrypted connection, not workflow JSON.

Start a connection from the selected Agent Team capability or from Settings. After the provider finishes, Codelit returns to the same route, preserves project context, and reopens the capability or Settings tab that requested the connection. A success message names the connected account, while a failed or cancelled connection returns to the same setup surface with the workflow unchanged.

Use native app capabilities for bounded reads and actions. Choose the app connection and exact capability on the responsible Agent card, then select Check setup to verify the saved credential, exact grant, required fields, and any discovered destination. The check uses a bounded no-write readiness probe and never sends the configured action. Google Workspace and Microsoft 365 use delegated sign-in; support, CRM, revenue, observability, and data apps use encrypted credentials when delegated access is unavailable.

Choose one Gmail, Calendar, Drive, Docs, Sheets, Outlook, Teams, OneDrive, or SharePoint capability, then continue on the provider's sign-in page. Codelit requests basic identity plus only that operation's delegated permission. Use Agent Team channel requests the Team, channel, sender-verification, message-read, and receipt-only reply permissions together so Trigger Hub can offer a real Team and channel picker. Use Agent Team inbox pairs bounded Gmail or Outlook read permission with send permission so Codelit can answer only through the original provider thread.

1. 1Select App capability on an Agent card, or open Settings > Apps > Connect more apps.
2. 2Choose the exact read or approval-gated action the team needs and continue with Google or Microsoft.
3. 3Review the consent screen. After approval, Codelit returns to the same card and marks only that capability ready.
4. 4Choose any discovered Team or channel, then select Check setup. A green result confirms readiness without sending a message, creating an event, or changing app data.

Access and refresh tokens are encrypted in the hosted vault and never enter workflow JSON, browser storage, analytics, or public receipts. Codelit refreshes an expiring token immediately before a run, stores rotated Microsoft refresh tokens, and preserves Google's existing refresh token during incremental consent.

• A revoked or expired authorization blocks the account and asks for reconnect.
• Reconnect must return the same provider identity; a different identity is added separately.
• Disconnect removes the local encrypted account and asks Google to revoke the delegated grant when supported.
• Temporary pasted access tokens remain under Advanced for migration and providers without a native OAuth setup.

Agent Team apps currently cover Google Workspace, Microsoft 365, Zendesk, Intercom, Stripe, Shopify, HubSpot, Salesforce, Sentry, PostHog, Datadog, PagerDuty, and Supabase. Each app exposes a small typed read and write surface rather than unrestricted API access.

• Work: Google Workspace and Microsoft 365.
• Support: Zendesk, Intercom, Stripe, and Shopify.
• Revenue: HubSpot and Salesforce.
• Engineering and data: Sentry, PostHog, Datadog, PagerDuty, and Supabase.

Connecting an app makes it available; adding its tool to an Agent Team card gives that responsibility permission to use it. Pick its exact resource and use Test read or Check setup in the card inspector. The run validator blocks design-only tools and missing credentials before Live run.

• Prefer a native action for reliable reads and writes.
• Use custom actions for an API Codelit does not yet model.
• Use Browser Operator when no suitable API exists.