Shared account

Generally your agent should use the company's own accounts. For instance, your support agent can check your GitHub issues to tell a customer whether their bug is fixed. Connect the company's account once, and every conversation uses it.

Use the company's account

Name the app's connection under connection:

agents/support/agent.yaml

name: support
mode: text
llm: llm-fast
connectors:
  - name: github
    connection: company # the label of a connection the app owns

Nobody is asked to sign in, so a test in the terminal uses it too:

getstream agents test support --sync

Ask: "What are the open issues in GetStream/awesome-ai-news?" to see the agent read GitHub as the company.

connection takes the connection's label or its id. Create the connection in the dashboard or from your backend before the agent syncs.

Create it from your backend

$STREAM_ACCELERATION_URL is your router's URL, and $SERVER_TOKEN is a server token: an HS256 JWT of {"server": true} signed with your API secret.

Create the connection

For a shared GitHub account, a personal access token is the simplest. Create the connection with "auth_scheme": "bearer":

curl -X POST "$STREAM_ACCELERATION_URL/v1/agents/connections" \
  -H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
  -H "Authorization: Bearer $SERVER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"connector_id": "github", "owner": {"type": "app"}, "label": "company", "auth_scheme": "bearer"}'

It returns the connection, pending, with its id and "revision": 1.

Save the token

Use that id as $CONNECTION_ID:

curl -X PUT "$STREAM_ACCELERATION_URL/v1/agents/connections/$CONNECTION_ID/credentials" \
  -H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
  -H "Authorization: Bearer $SERVER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"expected_revision": 1, "values": {"token": "github_pat_..."}}'

expected_revision is the connection's revision as you last read it. The connection is now connected, and the token is never shown again.

Check it

The token isn't checked when you save it, so a made-up one shows connected too. Ask GitHub once after saving:

curl -X POST "$STREAM_ACCELERATION_URL/v1/agents/connections/$CONNECTION_ID/validate" \
  -H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
  -H "Authorization: Bearer $SERVER_TOKEN"

The status stays connected when GitHub takes the token, and turns to needs_reauthorization when it refuses it.

Shopify needs the shop's myshopify.com address and no sign-in. Create its connection with that address, then save empty credentials to connect it. Use the id the first call returns as $CONNECTION_ID:

curl -X POST "$STREAM_ACCELERATION_URL/v1/agents/connections" \
  -H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
  -H "Authorization: Bearer $SERVER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"connector_id": "shopify", "owner": {"type": "app"}, "label": "shop", "inputs": {"shop": "mystore.myshopify.com"}}'

curl -X PUT "$STREAM_ACCELERATION_URL/v1/agents/connections/$CONNECTION_ID/credentials" \
  -H "api_key: $STREAM_API_KEY" -H "stream-auth-type: jwt" \
  -H "Authorization: Bearer $SERVER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"expected_revision": 1, "values": {}}'

Then use it with connection: shop:

agents/support/agent.yaml

name: support
mode: text
llm: llm-fast
connectors:
  - name: shopify
    connection: shop

getstream agents test support --sync

Ask: "Do you ship to Canada?" to see the agent search the shop's policies.

Going further

Each user's account

Let each user sign in, from the dashboard or your own app.

Choosing tools

Offer only the tools the agent needs.

Custom connectors

Any MCP server: public, behind a key, or with a sign-in.

Connectors

Whose account, the catalog, and the keys of a connector entry.

Troubleshooting

Errors you may see, why, and what to do.