Connect your other apps

Your agent can work with the other apps you use: a booking tool, a form, your CRM, a spreadsheet, or an automation tool such as Zapier, Make or n8n. This guide uses the names you will see in those apps (webhook, API key, bearer token, signing secret, client ID) and walks through real examples: which key to create, which way it goes, and exactly where to paste each URL and key. Everything starts on your agent’s Access page.

Which connection do I need?

You want	Use	Where the key comes from	Where you paste it
Another app to start your agent (a new booking, a form, a paid invoice)	Incoming webhook	Your agent makes the webhook URL and the secret	In the other app (or Zapier, Make, n8n): the URL, and the secret as a header
Your agent to tell another app when something happens	Outgoing webhook	The other app gives you its webhook URL; your agent makes a signing secret	The URL on your agent’s Access page; the signing secret back in the other app, if it checks signatures
A dashboard to show what your agent does, live	Event stream (API key)	Your agent makes the API key	In the dashboard: the stream URL and the key as a header
ChatGPT, Claude, Cursor or another AI tool to use your agent	AI tools (MCP server and API keys)	Your agent makes the API key, or you sign in instead	In the AI tool: the MCP server URL, and the key if it asks for one
An app that asks for a “client ID and secret”	OAuth app	The app gives you a redirect URL; your agent makes the client ID and secret	The redirect URL on your agent’s Access page; the client ID, secret and URLs in the app
Your agent to use Gmail, Calendar, Slack or another app for you	Not on Access	Connect it under Credentials (see Connections).

Owners and admins of the agent create these. Every secret and key is shown once, right after you create it.

Words you will see

Webhook and webhook URL: a web address one app calls to tell another app that something happened. Incoming means an app calls your agent; outgoing means your agent calls an app.
API key or bearer token: a long secret, like a password for apps. The app sends it in a header named Authorization, with the value Bearer, a space, then the key.
Header: a named field an app sends along with the data. Automation tools have a “Headers” section with a name box and a value box.
Signing secret: a secret both sides know, used to sign each message so the receiver can check it is genuine. Apps that support it call it a signing secret or HMAC secret.
JSON: the format most apps use for the data they send, for example {"name": "Ana", "email": "ana@example.com"}.
MCP server URL: the address AI tools use to connect to your agent.
OAuth client ID and client secret, redirect URL (also called callback URL), authorization URL, token URL and scopes: the fields an app asks for when it connects through a sign-in.

Incoming webhook: another app starts your agent

On your agent first. The webhook URL and its secret come from your agent:

Open your agent, then Access, and find Webhooks and integrations → Incoming webhook.
Give it a Name, such as new-booking.
Under When this fires, your agent should…, write the instruction in plain words, such as “Add the booking to my calendar and send the client a confirmation draft.”
Under How the other app proves it’s allowed, choose Bearer token for Zapier, Make, n8n and most no-code tools. Choose Signing secret only when the app or your developer can sign requests.
Press Create incoming webhook. Copy the secret now: it is shown once. Then copy the Webhook URL listed under the new webhook.

Example: a new Google Sheets row starts your agent, through Zapier

In Zapier, create a Zap. For the trigger, pick your app and event, for example Google Sheets → New Spreadsheet Row, and connect your sheet.
Add an action: Webhooks by Zapier (on paid Zapier plans) → event POST.
URL: paste the Webhook URL from your agent.
Payload Type: json. Under Data, add the fields your agent should see (for example name, email, date) and map each one from the trigger.
Under Headers, add one header. Name: Authorization. Value: Bearer followed by the secret you copied (one space after Bearer).
Test the step. On your agent’s Access page, open the webhook’s Delivery log: it shows Delivered, and your agent starts a conversation with your instruction and the row’s details.

Example: a form response starts your agent, through Make

In Make, create a scenario that starts with your form app, for example Typeform → Watch Responses.
Add the module HTTP → Make a request.
URL: paste the Webhook URL. Method: POST.
Headers: add an item with Name Authorization and Value Bearer plus your secret.
Body type: Raw. Content type: JSON (application/json). Request content: the answers as JSON, for example {"name": "<mapped name>", "email": "<mapped email>"}.
Run the scenario once and check the Delivery log on your agent.

Example: n8n

Add an HTTP Request node. Method POST, URL = the Webhook URL. For authentication choose Generic Credential Type → Header Auth, with Name Authorization and Value Bearer plus your secret. Turn on Send Body as JSON with the fields your agent needs.

ℹ Info:Many form and booking tools have their own “webhook” setting that takes only a URL and cannot add a header. Send those through Zapier, Make or n8n as above, so the secret travels in the header. Never put the secret in the URL or in the data.

If the Delivery log says “Refused: failed the check”, the secret is missing or typed wrong: check the header name is exactly Authorization and the value starts with Bearer and a space. New secret makes a fresh one; the old one keeps working for 24 hours while you update the other app. Pause stops it without deleting it.

Signing secret, for developers: sign each request with HMAC-SHA256 of the timestamp, a dot and the raw body, and send it in the headers X-Signature-Timestamp and X-Signature. Details: Webhooks and live events.

Outgoing webhook: your agent tells another app

Here the URL comes from the other app, and you paste it into your agent. First, under Events your agent may send on the Access page, list what your agent may send (for example report.ready, or * for anything). Then tell your agent in plain words when to send: “When you finish a client report, send report.ready with the client’s name and the link.”

Example: your agent's events start a Zap

In Zapier, create a Zap with the trigger Webhooks by Zapier → Catch Hook. Zapier shows a webhook URL that starts with https://hooks.zapier.com/hooks/catch/. Copy it.
On your agent’s Access page, under Outgoing webhook, paste it into The other app’s webhook URL. Optionally limit it to some event types, such as report.*. Press Add outgoing webhook.
Your agent shows a signing secret once. Zapier does not check signatures, so you can keep it or ignore it.
Ask your agent to send a test event (“Send report.ready with a test client”), then press Test trigger in Zapier. Add the actions you want, such as a Slack message or a new spreadsheet row.

Example: Make

Start a scenario with Webhooks → Custom webhook, press Add, and copy the address Make shows. Paste it into Outgoing webhook on your agent, then send a test event so Make learns the data structure.

What arrives: a JSON body with the event’s type, the time (ts), an id, and the details your agent included under data. Apps that check signatures compare the X-Signature header with the signing secret. If the other app does not answer, your agent tries again 5 more times over about half an hour, then tells you in the Inbox. Each outgoing webhook has a Delivery log.

Event stream (API key): a dashboard follows your agent

For a developer, or a dashboard tool that can read a live stream (server-sent events).

On the Access page, under Event stream (API key), name the key after the dashboard, such as “Sales dashboard”.
Choose what it may do: Watch live, Catch up on past events, or both. Optionally limit the event types and pick when it expires.
Press Create API key and copy the key: it is shown once.
In the dashboard, use the Stream URL (live) or the Catch-up URL, and add the header Authorization with the value Bearer plus the key.

To see it work from a terminal: curl -N -H "Authorization: Bearer <key>" "<Stream URL>" prints each event as your agent sends it.

AI tools: ChatGPT, Claude, Cursor and others

Under AI tools (MCP server and API keys) on the Access page, create an API key (or sign in instead, where the tool offers it), then open Use it from your AI tools: it gives the exact steps for ChatGPT, Claude, Claude Code, Cursor, Grok and Meta Muse, with your agent’s MCP server URL filled in. The key goes from your agent into the AI tool, never into a chat. More: API keys for other tools.

OAuth app: an app that asks for a client ID and secret

Some apps connect only through a sign-in and ask you for a client ID, a client secret and a few URLs, for example Microsoft Copilot Studio (manual setup), Gemini Enterprise, or n8n with fixed credentials. Here the keys go both ways:

In the other app, start adding a connection with OAuth 2.0 (manual or custom setup). It shows a redirect URL (sometimes called callback URL). Copy it.
On your agent’s Access page, under OAuth apps (client ID and secret), enter a Name (such as “Copilot Studio”), paste the redirect URL into Redirect URLs, keep With a secret selected, and press Create app client.
Copy each field your agent shows into the matching field in the other app: Client ID, Client secret (shown once), Authorization URL, Token URL (also the refresh URL) and Scopes. If the app asks about PKCE, turn it on with S256.
Save. The first time each person uses it, they sign in with their own account. The client grants nothing by itself.

Keep it safe

Paste keys and secrets only into the other app’s settings: never into a chat, an email or a shared document.
One key or webhook per app, named after it, so you can pause or delete one without touching the others.
If a key or secret may have leaked, press New secret or Revoke on the Access page and update the app.
Delete what you no longer use. Each API key shows when it was last used, and each webhook has a delivery log.

Reference for developers: Webhooks and live events. Stuck? See Getting help.