# Connect an account

> Source: https://elaichi.ai/docs/guides/connections/connecting-an-account/

Authorize a product account so Elaichi can turn its documented methods into tools your agents can run. A **connection** is one authorized account for a product — your Jira, your team’s shared HubSpot, or the company’s Salesforce.

**Where to find it:** **Connections** → **Add connection**

Credentials live in a secure vault and are only used when a tool runs. Elaichi keeps the details around them: which product, who owns the connection, and whether it still works.

## Permissions you need

| Permission | What it allows |
| --- | --- |
| `connection:create` | Connect an account for your own use. |
| `connection:share` | Share a connection with a **team** or with **everyone at your organization**. |
| `connection:manage` | Reconnect, edit, or delete a connection you own or hold an `edit` share on (not required to create your own). |

Members of the built-in **Member** role can connect accounts and share them with a team or everyone at your organization — `connection:share` is included from **Member** upward.

Administrators can also [restrict connectors](/guides/governance/set-restrictions) per role or member. Restricted connectors are blocked at connect time.

## Owner and access

Two separate things decide who can reach a connection.

**The owner** is whoever connected the account. There is no ownership choice to make when you connect. You can [transfer](/guides/connections/transferring-and-offboarding) a connection to someone else later without signing in again.

**Access** is a list of grants, and a new connection starts with none — it is private to its owner. Add grants in the optional **Share with** step, or later from the connection's **Manage access** dialog.

```mermaid title="Connection owner and access"
flowchart TD
  Connect["Connect an account"] --> Owner["You own it — private by default"]
  Owner --> Share{"Share with (optional)"}
  Share -->|"A member"| User["One person"]
  Share -->|"A team"| Team["Members of one team"]
  Share -->|"Everyone"| Org["Everyone at your organization"]
  Owner --> Tools["Tools run with vaulted credentials"]
  User --> Tools
  Team --> Tools
  Org --> Tools
```

Every grant carries a level:

| Level | What the grantee can do |
| --- | --- |
| **View** | See it and its configuration. Can’t run it. |
| **Use** | See it and run it. |
| **Edit** | Change its settings and who it’s shared with. |

A team grant needs a team — create one under **Settings → People → Teams** first if the list is empty.

## Connect an account

1. Open **Connections** and choose **Add connection**.
2. Search or filter by category, then select the product.
3. Optionally use **Share with** to add a member, a team, or everyone at your organization, each with a level. Leave it empty to keep the connection private.
4. Choose **Connect**. Elaichi opens the product’s authorization flow in an in-app window (OAuth products may open a consent popup inside that window).
5. Sign in with the product and approve the access it requests.

When the flow finishes, you see **Connection added** and the connection appears in the list with status **Active**.

:::callout{type="tip"}
Every **Active** connection automatically gets a **connection toolbox** under **Toolboxes → My toolboxes** (named like “{connection} tools”). It's usable through your organization's MCP endpoint right away, without building a shared toolbox first.
:::

## Status after connect

| Status | Meaning |
| --- | --- |
| **Active** | Ready to use. |
| **Pending** | Authorization hasn’t finished yet. |
| **Needs re-auth** | The product needs you to sign in again (expired or revoked access). Use **Reconnect**. |
| **disconnected** | The underlying account is no longer available. Reconnect or delete. |

Token refresh for working connections happens automatically behind the scenes. You only reconnect when the status asks for it.

## Reconnect

If a connection shows **Needs re-auth** (or you need to refresh access yourself):

1. Open **Connections**.
2. Choose **Reconnect** on the row (inline when status needs re-auth, or from the ⋮ menu).
3. Complete the authorization window again.

Reconnect preserves the same connection record and ownership. Credentials are rebound in place; toolboxes that already use the connection keep working once status returns to **Active**.

You can reconnect a connection you own, or any shared connection if you have `connection:manage`.

## Good to know

- Browse what a product can do under **Connectors** before you connect — the detail page lists its MCP tools (documented methods). Connecting itself always starts from **Connections → Add connection**.
- You only see connections you own and connections shared with you — directly, through a team you belong to, or with everyone at your organization. No organization permission widens that: an unshared connection stays private to the person who made it, even from an Org Owner.
- Deleting a connection immediately breaks toolboxes, and anything reaching them over your organization's MCP endpoint. Prefer transfer when someone leaves — see [Transfer and offboard](/guides/connections/transferring-and-offboarding).
- Sharing a toolbox that rides on a personal connection can nudge you to transfer that connection to the organization so teammates aren’t tied to your account.

## Related

- [Manage connections](/guides/connections/manage-connections)
- [Transfer and offboard](/guides/connections/transferring-and-offboarding)
- [Browse connectors](/guides/connectors/browse-connectors)
- [How toolboxes work](/guides/toolboxes/overview)