Connected account permissions
Understand OAuth permissions for connected accounts, what disconnecting really does, and how to review your active grants.
A connection is an OAuth authorisation that OpenbirdAI holds on your behalf. Understanding exactly what it grants, and how to remove it, is the practical side of account security.
What a connection grants
- Access to the services and scopes the provider approved.
- The ability to read data those scopes cover, inside your workspace.
- Nothing beyond that — no workspace administration, no other users' data, no password access.
Reviewing what is connected
- Open the integrations area.
- List each connection with its provider and account label.
- Remove anything you no longer use or no longer recognise.
- Remove the app from the provider's own account settings as well, so access is revoked upstream.
What disconnecting does
- Immediately removes the stored authorisation in OpenbirdAI.
- Stops all future reads from that provider.
- Does not delete previously produced answers; delete the conversations separately if needed.
- Does not revoke upstream access on its own — the provider must also be cleaned up.
Suspicious connections
- A connection you do not recognise → remove it, revoke upstream, and change your provider password.
- Unexpected behaviour after connecting a new app → assume compromise and act as above.
- A provider reporting unfamiliar app activity → revoke there first, then remove it in OpenbirdAI.
Where tokens are stored and why they never leak
Provider tokens are encrypted before they are stored and are never returned to a browser, a log line, or a model prompt. Tool execution reads the stored credential directly, so nothing a user types and nothing a document contains can influence which credential is used.
That design is why a prompt-injection attempt asking OpenbirdAI to "print the saved token" produces a refusal rather than a leak: there is no code path that would place a credential into a response in the first place, so there is nothing to refuse at the last moment.
Common questions
Does OpenbirdAI see my provider password?
No. Authorisation happens on the provider's site and only the resulting token is stored.
How do I review every active grant in one place?
The integrations area lists each connected account with its provider. Remove anything unrecognised there, then revoke OpenbirdAI from the provider's own settings.
How do I remove everything at once?
Remove each connection individually, then revoke OpenbirdAI in your provider account settings.