Use the account provider’s official delegated authorization flow: you sign in on the provider’s page, approve narrowly defined permissions, and give the agent a revocable token or brokered connection—not your password. For unattended work on shared company data, use a separate agent identity with only the application permissions that job requires.
The access model to choose
There is no universal “AI agent login.” The correct design depends on whose authority the agent should use, who owns the data, whether a person is present, and whether the service supports scoped authorization. Choose the pattern before connecting anything.
As an Amazon Associate I earn from qualifying purchases.
| Situation | Recommended pattern | Authority used | Interaction | Controls to verify |
|---|---|---|---|---|
| The agent reads or changes one person’s email, calendar, files, or other personal data | User-delegated OAuth authorization-code flow | The signed-in user, limited by approved scopes | Interactive sign-in and consent, usually at setup | Recognizable app name, exact scopes, read/write distinction, revocation method |
| An agent runs unattended over shared organizational data | Dedicated agent identity with application permissions or machine-to-machine OAuth | The agent or application identity | No individual needs to be present for each run | Dedicated identity, administrator approval, narrow resource permissions, audit logs |
| The user has authenticated to an agent and a downstream service must enforce that user’s existing rights | On-behalf-of token exchange | The user’s authority carried through an approved agent | The user signs in once; downstream calls use exchanged tokens | Identity provider and downstream service both support the exchange; user and agent context is preserved |
| The target only accepts an API key or legacy credential | Credential broker, proxy, or managed secrets service | A restricted service account or key, not a human administrator | Usually no repeated interactive consent | Raw secret never reaches the model, outbound destinations are allowlisted, rotation and revocation are available |
User-delegated OAuth for personal tasks
Delegated access is normally the safest fit when an agent is acting on your mailbox, calendar, drive, or files. The provider authenticates you directly. You then see a consent screen naming the application and the requested scopes. After approval, the agent receives an access token, or a service holds the token and brokers requests for it. The agent can act only within the permissions attached to that grant and the rights your account already has.
Microsoft describes delegated Microsoft Graph access as user-centric: the agent is bounded by what that user can access. AWS likewise documents the OAuth 2.0 authorization-code grant as a way for agents to reach user-specific data with explicit consent. Delegation does not make an agent an administrator; it gives the agent a controlled representation of your existing authority.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A dedicated identity for unattended work
Use an agent or application identity when the workload processes organization-owned data without a person supervising every request. A scheduled reporting agent, for example, should not reuse a department head’s password. Create a distinct identity, obtain administrative approval, and grant only the mailboxes, sites, repositories, queues, or API operations the workload needs.
Application permissions can be powerful because they are not automatically narrowed to whichever employee happens to be logged in. That makes resource-level controls, expiration, monitoring, and separation between workloads essential. Give each materially different workload its own identity where practical so that one compromise does not expose every system.
On-behalf-of exchange
An on-behalf-of flow is useful when the agent is a front end for a downstream service. The user signs in to the agent, the identity provider exchanges the user token for a downstream token, and the downstream service enforces its own authorization. This preserves both identities: the service can see which user is represented and which agent made the call. It works only when the identity provider and downstream API explicitly support the exchange.
Credential proxying for systems without OAuth
Some systems offer only API keys or older username-and-password interfaces. In that case, place the credential in a managed secret store or proxy. The proxy injects authentication into approved outbound requests while the model and agent code see neither the secret value nor an unrestricted environment variable.
Google’s managed-agent guidance describes proxy injection together with an outbound network allowlist. The allowlist should contain only the service destinations the workload needs. Google also warns that HTTP Basic Authentication sends a password in a form that is not recommended. A broker is a containment measure, not proof that a legacy protocol is safe; restrict the account itself, rotate the key, and replace the integration when the provider offers a modern option.
How delegated authorization works
1. The agent starts an authorization request
The integration sends you to the provider’s own sign-in and consent page. The request identifies the client application, a redirect destination, and the scopes it wants. A legitimate flow should not ask you to type your primary password into an agent prompt, paste a one-time code into a chat, or upload a session cookie.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. You authenticate with the provider
Sign in in the provider-controlled window, including multifactor authentication if required. The agent should not handle your password or recovery codes. If a browser extension, desktop wrapper, or custom page obscures the provider’s domain or application identity, stop and verify the integration through your organization’s approved channel.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute3. You approve named scopes
Read every permission. A request to read one calendar is materially different from a request to read and write all files, send mail as you, manage users, or administer a tenant. Decline a broad permission when the task can be completed with a narrower one. If the consent screen is vague, missing, or unexpectedly broad, do not continue until the application owner explains it.
4. The provider issues a token or brokered session
In an authorization-code flow, the application exchanges a short-lived code for an access token and sometimes a refresh token. The model should not be given either value as conversational context. Store tokens in provider-managed secure storage or behind a broker, limit which tools can call them, and prevent them from appearing in logs, browser history, traces, error messages, or source control.
5. The service enforces the grant on every call
An access token is a credential, but it is not a new password. Its effective authority is the intersection of the token’s scopes, the user’s existing rights, resource-level policies, and any service-side conditions. A token with write permission can still be misused by a faulty or compromised agent, so consequential actions need approval gates or policy checks in the service itself.
Safe setup: a practical sequence
- Define the task and resource. Write down the exact action and target: one folder, mailbox, calendar, repository, queue, or API endpoint. Classify the data as personal, shared organizational, or system-level. Do not start with “access the account”; start with “read these messages” or “create events on this calendar.”
- Check for an official integration. Prefer the provider’s hosted sign-in and consent page or your organization’s identity platform. Confirm that the service supports OAuth scopes, an approved API, or a documented agent integration. A normal consumer website may offer none of these. If it lacks a safe delegated or API path, do not promise password-free access; consider whether a controlled broker is acceptable or whether the task should be dropped.
- Review every requested permission. Map each scope to one task. Separate read from write, sending from drafting, and a single resource from an entire tenant. Refuse administrative, tenant-wide, or unrestricted file permissions when they are not necessary. Microsoft’s agent guidance specifically blocks examples of high-risk permissions for agent identities and favors delegated permissions for user-centric work.
- Select the identity type. Use your user-delegated grant when the agent is acting on your personal data. Use a dedicated application or agent identity for unattended shared-data processing. Do not use a human administrator’s password as a shortcut.
- Keep secrets behind a broker. If an API key or legacy credential is unavoidable, place it in a managed secret store or credential proxy. Permit only approved destinations and operations. Do not put the value in a system prompt, tool description, issue tracker, shell output, logs, or training data. Make sure the key can be rotated independently of the agent.
- Record ownership and lifecycle. Document who approved the connection, the application identity, scopes, resources, creation date, expiration date, and revocation procedure. Prefer access packages or grants that expire. Organizations should collect consent events, token issuance, and token-use logs in their central monitoring system.
- Test on a low-risk resource. Connect a test folder, mailbox, or project first. Verify that the agent can perform the intended action and cannot list or modify unrelated resources. Inspect the provider’s audit trail. For a temporary job, revoke the grant as soon as the work is complete.
Design permissions for least privilege
Scope the operation
Scopes should describe both an operation and a resource. “Read messages in this mailbox” is narrower than “read all mail.” “Create calendar events” is narrower than “read, edit, and delete every event.” Where the provider supports resource-level roles, use them instead of a broad application permission.
Recommended Free Tools
Separate read, write, and administrative actions
Many agents need to inspect information before they need to change it. Start with read-only access, then add a specific write capability only after the workflow is understood. Sending email, deleting files, changing sharing settings, adding users, and issuing payments deserve separate permissions and, for high-impact work, human confirmation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use time limits and revocation
Temporary access should have an expiration rather than relying on someone to remember a future cleanup. Microsoft documents revocable or expiring access packages, narrowly scoped Azure roles, mailbox-level Exchange roles, and per-team Teams permissions. Equivalent controls differ by provider, but the principle is the same: make the grant easy to remove and difficult to overlook.
Keep identities separate
A personal delegated token, a production automation identity, and a test identity should not be interchangeable. Separation improves auditability and limits the damage from a stolen token or a prompt-injection attack. Name identities for the workload and owner, not for an individual who may leave the organization.
Protect tokens from the agent itself
Giving an agent permission does not require giving it the token string. The safest architecture places token handling in a connector, gateway, or provider SDK. The agent submits a structured request such as “list unread messages in the approved mailbox,” and the connector adds authentication, calls the API, filters the result, and returns only the data needed for the next step.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Store access and refresh tokens in an encrypted, provider-managed or dedicated secret store.
- Prevent token values from being returned in tool results, exception text, telemetry, screenshots, and debug traces.
- Restrict outbound network destinations to the APIs the workload needs.
- Use short-lived access tokens where the provider supports them and protect refresh tokens more strictly than access tokens.
- Rotate API keys and service credentials on a schedule and after any suspected exposure.
- Revoke unused grants rather than merely deleting the agent configuration.
Google’s credential-proxy model is designed for this separation: the gateway can decrypt or inject a credential for an approved request without exposing the raw value to the managed agent. That is different from placing a secret in an environment variable that the model can inspect through a diagnostic tool.
Provider-specific capabilities and limits
Microsoft systems
Microsoft’s documentation distinguishes delegated permissions, in which an agent acts within a user’s rights, from application permissions for background services. Its examples include resource-level Azure role assignments, per-mailbox Exchange role-based access, per-team Teams permissions, and access packages that can expire or be revoked. Microsoft Entra Agent ID guidance also identifies high-risk permissions that are blocked for agent identities and recommends least privilege.
Labels and administration screens change, so use the current Microsoft Learn procedure for the particular Graph resource. The important checks are the same: identify whether the permission is delegated or application-wide, verify the resource boundary, set an expiration when available, and confirm that audit logs capture consent and use.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Google systems
Google’s Agent Identity material covers distinct agent identities, delegated OAuth, machine-to-machine OAuth, and API keys. Its managed-agent guidance places credentials in a proxy and uses an outbound network allowlist. It explicitly says HTTP Basic Auth is not recommended. A Google integration that asks for an API key should therefore be treated as a service-credential design: restrict the key by API and origin where supported, store it outside agent context, and monitor its use.
AWS systems
AWS describes several patterns rather than one universal agent login. User-delegated OAuth authorization code is intended for user-specific data and explicit consent. Client-credentials or machine-to-machine OAuth fits an unattended service with its own identity. On-behalf-of exchange fits a downstream service that must enforce the signed-in user’s rights. Compare these patterns by data ownership, whether a person must interact, when tokens are issued, the scope of authority, and how the call is audited.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Threats that OAuth does not solve
Malicious consent screens
OAuth can be abused by a malicious application that presents a plausible consent request. The Australian Cyber Security Centre’s September 2026 guidance warns that attackers can use legitimate OAuth flows to obtain enduring access without stealing credentials. The resulting tokens may continue working independently of the password and can survive a password reset.
Check the application name, publisher, redirect context, and every scope before approving. Organizations should log consent grants, token issuance, and token use, alert on unusual applications or scope increases, and remove grants that are not justified. Restrict device-code login where it is not required; device-code flows can be attractive to attackers because a user may authenticate on a separate trusted device while an attacker controls the initiating session.
Prompt injection and misdirected actions
Least privilege limits what a compromised agent can reach, but it does not make permitted actions safe. A malicious document or message could instruct an agent to forward data, delete records, or change sharing settings. For consequential writes, require a human approval step, enforce destination and content policies in the service, and separate retrieval tools from mutation tools.
Stale grants and forgotten tokens
Closing an agent, changing its prompt, or resetting a password may not invalidate an OAuth grant. Revoke the application consent or token through the provider’s controls. If a refresh token was issued, verify that revocation covers it and inspect logs for use after the supposed shutdown.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When a connection fails
The provider asks for a password in chat
Stop. An official integration should redirect authentication to the provider or an approved identity platform. Never paste a primary password, one-time code, recovery code, or session cookie into the agent.
The consent screen requests far more access than expected
Decline and identify which feature requires each broad scope. Ask the integration owner whether a read-only, resource-specific, or delegated alternative exists. If no narrower option is available, assess whether the task is worth granting that authority.
The agent works interactively but fails in scheduled runs
The integration may rely on delegated access that expires when the user session ends. For an unattended workload, provision a dedicated application identity or supported machine-to-machine flow. Do not solve the problem by storing a user’s password.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The service has no OAuth or API
Confirm that the service truly lacks an approved integration. If it requires a legacy credential, use a broker with an allowlist, a restricted account, rotation, and logging. If those controls are unavailable, the safe answer may be not to connect the agent.
Revoking access does not stop activity
Check for multiple grants, refresh tokens, service accounts, API keys, and copied credentials. Revoke each authorization path, rotate any exposed key, disable the dedicated identity if necessary, and review audit records for post-revocation use.
Quick Recap
Account-connection checklist
- The task and target resource are written precisely.
- The provider’s official authorization or API path is being used.
- No password, one-time code, recovery code, or session cookie enters the agent context.
- Each requested scope has a documented purpose.
- Read-only access is used until write access is demonstrably necessary.
- Unattended work uses a dedicated agent or application identity.
- Raw tokens and secrets stay behind a connector, proxy, or managed store.
- Outbound destinations are allowlisted.
- Approval, owner, scopes, resources, expiration, and revocation steps are recorded.
- Consent, token issuance, and token use are auditable.
- A low-risk test confirms the agent cannot reach unrelated data.
- Temporary grants are revoked after the task.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
