How Can an AI Agent Access a User’s Apps Without Seeing Their OAuth Tokens?

A practical field guide from Automation Ace.

Short answer: an AI agent can use a user's apps without seeing their OAuth tokens by calling tools that run on a server that holds the tokens, rather than calling the APIs itself. The user connects their apps through a managed auth platform such as Composio, Nango, Pipedream Connect, or Arcade; your backend gives the agent tools (or a short-lived MCP session) scoped to that user's ID; and when the model calls a tool, the platform injects the token, makes the API call, and returns only the result. The model only ever sees tool names, arguments, and results.

Short answer

• Tokens live with the auth platform, never in prompts, tool inputs, or the model's context.
• The agent gets tools or an MCP session scoped to one user.
• Your backend decides which user and which tools; the model decides only which allowed tool to call.
• When access is missing, the agent hands the user a connect link instead of asking for a password or token.

Why tokens should never reach the model

• Context leaks: anything in the context can end up in outputs, logs, traces, or another tool's input.
• Prompt injection: a malicious email or web page could ask the agent to send its token somewhere.
• Over-broad access: a raw token can call any endpoint its scopes allow, not just the actions you intended.
• No revocation story: a copied token keeps working until it expires.

The architecture

User ──(signs in to your app)──> Your backend
                                   │  knows: user_id
                                   │  holds: platform secret key (never sent to the model)
                                   ▼
                     Managed auth / MCP layer
                     (Composio, Nango, Pipedream Connect, Arcade)
                                   │  holds: the user's OAuth tokens
                                   │  exposes: tools scoped to user_id
                                   ▼
LLM / agent ──(tool name + arguments)──> tool runs with the user's token
            <──(result data only)──────

Patterns that keep tokens away from the agent

For how the model picks and calls tools, see how AI agents use tools. For the trade-offs between calling APIs, proxies, and MCP, see direct API calls vs authenticated proxies vs MCP tool calls.

Example: a per-user session

# Create a per-user agent session (Nango agent sessions shown)
curl --request POST https://api.nango.dev/sessions \
  --header "Authorization: Bearer $NANGO_SECRET_KEY" \
  --header "Content-Type: application/json" \
  --data '{
    "tenant": { "connections": { "any": [ { "tags": { "end_user_id": "user_123" } } ] } },
    "toolset": { "google-mail": { "allow": { "tools": ["list-emails", "draft-email"] } } },
    "expires_in": "1h"
  }'
# -> { "data": { "mcp_url": "...", "session_token": "..." } }
# Give the agent mcp_url with session_token as bearer auth. No Gmail token involved.
# (Tool names are examples; list the integration's tools to get the real ones.)

The session selects the user's connection by tag and allows only two Gmail tools for one hour. Composio does the equivalent by loading tools for a user ID, Pipedream Connect by external user ID, and Arcade by user ID.

Just-in-time connection links

When the agent needs an app the user has not connected, the platform returns an authorization or connect link (Arcade's tool authorization and Nango's connection meta tool both work this way). The agent shows the link, the user approves in the app's own consent screen, and the agent tries again. The user never types a password or token into the chat, and you never ask for one.

What can still go wrong

Hiding tokens limits damage but does not limit actions. Pair it with limits on which app actions the agent can take and approvals and audit trails.

Platforms that support this

• Composio: tools scoped to a user's connected accounts.
• Nango: agent sessions with an MCP URL, tool allow and deny lists, and connection selection by tag.
• Pipedream Connect: MCP and actions for an external user ID.
• Arcade: tool calling with per-user authorization and MCP gateways.
• Zapier MCP: the same idea for your own account's apps.

Compare them in the best managed app auth platforms, and see managing app connections for a multi-user agent.

Frequently asked questions

How can an AI agent use my apps without seeing my OAuth tokens?

The agent calls tools on a server that holds your tokens, such as a managed auth platform or MCP server. The server adds your token, calls the app, and returns only the result, so the model sees tool names, arguments, and results but never the token.

Is it safe to put an API key or OAuth token in an AI agent’s prompt?

No. Anything in the context can leak into outputs, logs, or other tools, and prompt injection could exfiltrate it. Keep credentials on the server and give the agent tools instead.

What is a just-in-time authorization link for an AI agent?

When a tool needs access the user hasn’t granted, the platform returns a link to the app’s consent screen. The agent shows the link, the user approves, and the agent retries, without the user sharing passwords or tokens in chat.

Does hiding tokens make an AI agent safe?

It limits what can leak, but not what the agent can do with the tools it has. Also restrict tools to an allowlist, require approval for risky actions, and log every call.

Which platforms keep OAuth tokens away from AI agents?

Composio, Nango, Pipedream Connect, Arcade, and Zapier MCP all run app actions server-side with stored credentials, so agents use tools rather than tokens.