Docs / Connectors

Connectors

Connect team tools and personal accounts, control who can use each one, and choose which ones a conversation may use.

Connect the systems your work needs: source control, issue trackers, cloud accounts, observability, databases and documents. You can start with local code and add connections later. Coding work does not need a cloud account.

For what each connector lets you and the agent do, see What each connector can do.

How connecting works

There are two kinds of connections.

Team connectors

A team connector is shared by the team. Only Admins can add one.

1. Open Connectors in the sidebar.
2. Find the connector and click Add. On a connector that already has connections, click Add connection.
3. Follow the dialog. Depending on the provider, you set up cloud trust, authorize in your browser, or paste a token.

Once connected, the row shows Connected, or Needs attention when a connection has a problem.

Personal Credentials

For your own GitHub, Linear, Gmail or Google Drive, use Settings → Account → Personal Credentials. The agent then acts as you: it uses these accounts when you send a message, and for automated runs in conversations you own.

• A personal account is not a team-wide service identity. Check which account will act before you ask an agent to publish something.
• Gmail and Google Drive need a Google OAuth client set up in team settings first.
• Disconnect returns your messages to the team's credentials and revokes the grant at the provider.

Who can use a connection

Each team connection has its own Access List, which an Admin edits with Manage access on the connector's page. It controls which team members can use the connection, including from their agents.

• Most connections start with All members are allowed.
• A few, such as Upstash and Trello, start with only the person who connected them.
• Viewers never get cloud credentials, whatever the list says.

Pangea checks the list on every credential request. See Access control.

Choose connections per conversation

Each conversation uses only the connections selected for it. Pick them in the composer under Agent credentials. You can select all, clear all, or pick single accounts and roles. Your role, the access lists and the provider's own permissions still apply.

Some entry points start with a different selection. For example, a conversation started over MCP starts with every credential you can use, except Resend, which sends email. Review the selection before you work with production.

Authentication depends on the provider

Short-lived access tokens do not mean that no integration stores a long-lived refresh token or secret. See IAM trust model.

A local runtime may also use sign-ins that are already on its computer. Selecting connections does not remove those sign-ins.

Find a connection

Some connectors have their own resource pages in the app. Others work through the agent. A resource list in the app does not limit what the authorized provider CLI or API can do.

Read, change and automate

• Permission modes govern the runtime's action prompts.
• Plans make significant cloud work reviewable. They don't gate every write to every integration.
• The provider's permissions are the hard limit. Full Access can't turn a read-only token into a write token.

A Watch turns an alert into agent work. It needs a provider notification path, a Pangea trigger, an approved destination when it posts to chat, a test run and a clean-up plan. Slack is the main incident-delivery path, so don't assume every chat integration supports every Watch destination. The Monitoring view brings together Grafana, Better Stack and Google Cloud. Other providers have their own pages.

Verify and disconnect

• After you connect, run a small read against the expected account or workspace. Then select the connection in the conversation where you need it.
• A successful sign-in does not prove that every project, page or Kubernetes permission is in place.
• Remove a team connection from Connectors, or a personal one from Personal Credentials, when it should no longer be used. Revoke unneeded tokens and cloud trust at the provider too.
• Removing a connection does not delete cloud resources or earlier transcripts.