For teams building AI agents
The access and authorization layer for agents.
Your agents act for real people: in their email, their accounts on websites, their tools. OneXnect connects those accounts, keeps the credentials, checks every call against what each user allowed, and asks the user before anything is changed.
What OneXnect does
Connect once
Your users connect their accounts through OAuth, an API key, or a hosted sign-in page for websites without an API. That sign-in page shows your name and the website's, not ours.
Credentials stay with us
Tokens, cookies and sessions are encrypted and added to each request on its way out. They never reach a model, a prompt or a log, even when a service echoes one back.
Grants per agent
Each agent uses only the services it declared and its user allowed. One agent's access is changed or revoked without touching the others.
Writes ask first
Reads run at once. A write waits for the user's decision, relayed by your app, unless they granted that tool to that agent. A webhook tells you it is waiting.
Websites stay signed in
A hosted browser, signed in as the user. When a site's session lapses, OneXnect signs back in through the user's sign-in provider where it can, and tells you when it can't.
Your limits, your record
Rate limits, daily totals and pauses are set on the dashboard, never through the API, so a leaked key can't raise them. Every grant, decision and key change is logged.
How it works
Every request carries your tenant key: Authorization: Bearer acs_…
- 1
Register a user and an agent
Once per person and per agent. We issue the ids; yours goes in external_ref.
POST /users {"external_ref": "your-user-42"} → 201 {"id": "usr_…", "token": "ust_…"} POST /tenant/agents {"name": "Inbox assistant", "required_services": ["gmail"]} → 201 {"id": "agt_…"} - 2
The user connects
Open the address for them. They come back to your app, connected.
POST /connections/gmail/oauth X-User-Id: usr_… X-User-Token: ust_… → 200 {"authorize_url": "https://…"} - 3
The agent calls a tool
The same call for API tools, the user's MCP servers and websites.
POST /tools/call X-User-Id: usr_… X-User-Token: ust_… X-Agent-Id: agt_… {"tool": "search_emails", "arguments": {"query": "from:billing@acme.com"}} → 200 {"ok": true, "summary": "…", "data": {…}}
Built as a custodian
We hold what your users trust you with, and hold back only what keeping it safe requires. Your limits and your users' decisions are yours; we enforce them.
- A tenant key alone acts for no user: every call for a user carries that user's own token.
- Each tenant's and each user's rows are kept apart by the database itself.
- A sign-in link is signed, opens in one browser only, and expires in 30 minutes.
- A user's Google, Apple or Microsoft session is never loaded into a browser a person or an agent drives.
- What a service returns is relayed whole. We don't trim, rewrite or judge your data.
Pricing
Start free, no card. Pay for tool calls and browser minutes as you grow.
Free
- 2,000 tool calls a month
- 60 browser minutes a month
- Up to 10 connections
- No card
Pro
- 5,000 tool calls, 1,000 browser minutes and 10 new API connections included each month
- Then $0.005 per tool call, $0.005 per browser minute, $0.10 per new API connection
Enterprise
- Volume prices
- Invoices and bank transfer
- Write to support@onexnect.com