Connecting an app

What happens

Pressing Connect sends you to the vendor with a single use state value. When you approve, the vendor returns to Selat, the tokens are sealed with AES-256-GCM under a key bound to your workspace, and the provider’s tools appear in your catalog.

Your gateway credential does not change. An agent already running keeps working and picks up the new tools on its next tools/list.

Disconnecting

Disconnect deletes the stored tokens and removes the provider’s tools from the catalog. It does not revoke your consent at the vendor, so remove Selat from the vendor’s own connected apps screen as well if that is what you meant.

When a connection expires

Refresh happens on our side and you will not normally notice it. When a vendor rejects the refresh, for example after a password change, the next call fails with a code your agent can branch on rather than a silent empty result:

{"error":{"code":"reauth_required","message":"github needs to be reconnected",
  "provider":"github","reauth_url":"https://...","request_id":"..."}}

Follow reauth_url and connect again. Nothing else needs changing.

What some vendors require first

A few connections need more than an account, and getting this wrong shows up much later as writes that always fail. Facebook needs a Page and an admin role on it. Instagram and Threads need a business or creator account to publish. TikTok needs a business account.

The Google connections carry a different limit. Our Google consent screen is still in testing, so you have to be added as a test user, Google shows its own unverified warning, and the connection stops working after seven days. Gmail and Drive read access are restricted scopes under Google’s rules, which means publishing them requires an annual third party security assessment. Calendar does not.

The Connections page says which of these applies before you press the button.