Connectors Setup & Integrations Reference
Aigenzey Cowork connects securely to your workplace applications and data sources on your behalf. Whether you are an individual professional looking for instant 1-click connections or an enterprise IT leader configuring corporate-owned OAuth applications, Cowork ensures seamless and compliant integration.
If you are using a Personal Account, you do not need to configure developer apps, API credentials, Client IDs, or redirect URLs. All integrations work out of the box with standard 1-click authorization!
Personal Accounts: Instant 1-Click Connect
For individual productivity users, connecting external tools is completely effortless:
- Prompt-Driven Authorization: Ask the agent to perform an action with any external tool (e.g. "Check my upcoming events in Google Calendar" or "Draft an email in Gmail").
- 1-Click Connect: The agent immediately presents a Connect button in your chat stream. Clicking it opens the provider's standard consent screen.
- Immediate Execution: Once authorized, the agent automatically completes your requested task. You only need to authorize each application once.
You can view, manage, or disconnect your personal accounts at any time from the Connections tab in the Cowork sidebar.
The remainder of this guide is designed for IT Administrators and Business Leaders who wish to route authorizations through their own corporate developer apps, enforce departmental access rules, or restrict specific connectors across their organization.
Business & Enterprise: Corporate App Configuration
While Business workspaces can leverage secure platform-managed connections by default, enterprise IT policies often mandate that employee authentications flow through internally owned corporate applications (e.g. your company's own Google Cloud Project, Microsoft Entra ID Enterprise App, or Salesforce Connected App).
Organization Administrators can enter their corporate app credentials, restrict connector availability, and govern connector permissions from Admin Panel → Connectors.
Enterprise Security & Permission Standards
Aigenzey Cowork adheres to strict enterprise least-privilege standards across all integrations:
- Principle of Least Privilege: Scopes are strictly limited to the minimum permissions required for discovery, reading, and authorized actions (e.g. email scopes intentionally exclude permanent mailbox deletion; chat scopes utilize focused search rather than broad organizational access).
- Native Access Control Inheritance: The agent operates strictly under the authenticated user's native permissions. If an employee cannot access a file, ticket, or record in the native system, the agent cannot access it either.
- Live Federated Querying: Cowork queries external services in real time during active sessions rather than bulk-replicating business data into unmanaged storage.
Zero-Trust Credential Isolation
Aigenzey Cowork implements enterprise-grade token isolation:
- Individual User Scoping: Every authenticated connection is strictly tied to the individual user and their organization.
- Zero Cross-User Sharing: Even for shared enterprise platforms (Salesforce, NetSuite, Workday, HubSpot), credentials remain private to the user who authorized them. Team members can never execute actions using another colleague's credentials.
- Enterprise Encryption at Rest: All stored access tokens and credentials are protected with military-grade authenticated encryption.
- Cryptographic Request Validation: Authorization flows utilize cryptographically signed tokens to prevent request forgery and session hijacking.
- Seamless Token Refresh: Expired session tokens are refreshed automatically in the background, ensuring smooth and uninterrupted workflow execution.
Admin Console & Connector Governance
From Admin Panel → Connectors, Organization Administrators have full governance over the connector ecosystem:
- Custom Corporate Credentials: Provide your corporate Client ID, Client Secret, and organization subdomain so that employee authorizations display your company's verified branding and security profile.
- Departmental Access Restrictions: Restrict high-impact integrations (e.g. Salesforce, NetSuite, Stripe, Workday) to specific departments such as Sales, Finance, or HR.
- Connector Enablement Controls: Disable unapproved connectors across your entire organization with a single click, instantly preventing new connections while safeguarding existing configurations.
To ensure security integrity, custom credentials must be supplied as a complete set (Client ID, Client Secret, and Tenant/Subdomain where applicable). Partial configurations will not take effect until all required fields are validated.
Authorized Redirect URIs
When registering custom enterprise applications in your provider's developer console (e.g. Google Cloud, Microsoft Entra ID, Atlassian, Salesforce), configure the Authorized Redirect URI with the Aigenzey Cowork domain:
| Connector Type | Authorized Redirect URI | Usage |
|---|---|---|
| Built-in Enterprise Connectors | https://cowork.aigenzey.com/auth/<connector_name>/callback | Used for all standard OAuth integrations (e.g. /auth/google/callback, /auth/slack/callback, /auth/salesforce/callback). |
| Custom API & Service Integrations | https://cowork.aigenzey.com/auth/custommcp/callback | Standard redirect URI for custom internal services configured with OAuth 2.0. |
Enterprise Provider Matrix & Required Scopes
Below is the comprehensive configuration reference for supported enterprise applications, including required admin fields and exact OAuth scopes to configure in your developer portals.
1. Google Workspace
Configure in Google Cloud Console → APIs & Services → Credentials → OAuth 2.0 Client IDs. Enable the corresponding Google APIs in your Google Cloud project.
| Service | Callback Slug | Admin Fields | Required OAuth Scopes |
|---|---|---|---|
| Gmail | google | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/gmail.readonlyhttps://www.googleapis.com/auth/gmail.composehttps://www.googleapis.com/auth/gmail.sendhttps://www.googleapis.com/auth/gmail.modify |
| Google Calendar | gcalendar | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/calendar.readonlyhttps://www.googleapis.com/auth/calendar.events |
| Google Drive | gdrive | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/drive.readonly |
| Google Docs | gdocs | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/documents.readonlyhttps://www.googleapis.com/auth/drive.readonly |
| Google Sheets | gsheets | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/spreadsheets.readonlyhttps://www.googleapis.com/auth/drive.readonly |
| Google Slides | gslides | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/presentations.readonlyhttps://www.googleapis.com/auth/drive.readonly |
| Google Chat | gchat | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/chat.spaces.readonlyhttps://www.googleapis.com/auth/chat.messages.readonly |
| Google Meet | gmeet | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/meetings.space.readonly |
| Google Tasks | gtasks | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/tasks.readonly |
| Google Contacts | gcontacts | Client ID, Client Secret | openidhttps://www.googleapis.com/auth/userinfo.emailhttps://www.googleapis.com/auth/userinfo.profilehttps://www.googleapis.com/auth/contacts.readonly |
2. Microsoft 365 & Microsoft Graph
Register in Microsoft Entra ID (Azure AD) → App registrations. Add Microsoft Graph Delegated permissions.
| Service | Callback Slug | Admin Fields | Required Delegated Permissions |
|---|---|---|---|
| Microsoft Teams | teams | Client ID, Client Secret, Tenant ID | User.Read, Team.ReadBasic.All, Channel.ReadBasic.All, offline_access |
| Microsoft Outlook | outlook | Client ID, Client Secret, Tenant ID | User.Read, Mail.Read, Mail.ReadWrite, Mail.Send, Calendars.Read, Calendars.ReadWrite, offline_access |
| Microsoft OneDrive | onedrive | Client ID, Client Secret, Tenant ID | User.Read, Files.Read.All, offline_access |
| Microsoft SharePoint | sharepoint | Client ID, Client Secret, Tenant ID | User.Read, Sites.Read.All, offline_access |
| Microsoft OneNote | onenote | Client ID, Client Secret, Tenant ID | User.Read, Notes.Read.All, offline_access |
| Microsoft To Do | mstodo | Client ID, Client Secret, Tenant ID | User.Read, Tasks.Read, offline_access |
| Microsoft Planner | planner | Client ID, Client Secret, Tenant ID | User.Read, Group.Read.All, Tasks.Read, offline_access |
3. Development & Project Management
| Service | Callback Slug | Admin Fields | Required OAuth Scopes |
|---|---|---|---|
| GitHub | github | Client ID, Client Secret | read:user, repo |
| GitLab | gitlab | Client ID, Client Secret | read_user, read_api, read_repository |
| Jira (Atlassian) | jira | Client ID, Client Secret | read:jira-work, write:jira-work, read:jira-user, offline_access |
| Confluence (Atlassian) | confluence | Client ID, Client Secret | read:confluence-content.all, write:confluence-content, read:confluence-space.summary, offline_access |
| Linear | linear | Client ID, Client Secret | read |
| Asana | asana | Client ID, Client Secret | default |
| Notion | notion | Client ID, Client Secret | Configured via Notion integration consent screen |
4. CRM, Revenue & Customer Support
| Service | Callback Slug | Admin Fields | Required Scopes & Notes |
|---|---|---|---|
| Salesforce CRM | salesforce | Client ID, Client Secret, Custom Login URL, Department Restrictions | api, refresh_token, offline_access |
| HubSpot CRM | hubspot | Client ID, Client Secret, Department Restrictions | crm.objects.contacts.read, crm.objects.deals.read, oauth |
| Stripe | stripe | Client ID, Client Secret, Department Restrictions | read_only |
| Zendesk | zendesk | Client ID, Client Secret, Subdomain | read |
| Slack | slack | Client ID, Client Secret | search:read.public, search:read.private, channels:read, chat:write, reactions:write |
| Intercom | intercom | Client ID, Client Secret | Configured inside Intercom App Developer Portal |
| Zoom | zoom | Client ID, Client Secret | user:read, meeting:read |
| Discord | discord | Client ID, Client Secret | identify, guilds |
5. ERP, HR & Enterprise ITSM
| Service | Callback Slug | Admin Fields | Permissions & Access Notes |
|---|---|---|---|
| Workday | workday | Client ID, Client Secret, Host, Tenant, Department Restrictions | Configured via Workday Integration System User (ISU) permissions |
| Rippling | rippling | Client ID, Client Secret, App Name, Department Restrictions | Configured in Rippling App manifest |
| BambooHR | bamboohr | Client ID, Client Secret, Subdomain, Department Restrictions | offline_access |
| Oracle NetSuite | netsuite | Client ID, Client Secret, Account ID, Department Restrictions | rest_webservices, offline_access |
| ServiceNow | servicenow | Client ID, Client Secret, Instance URL, Department Restrictions | useraccount (REST Table API & Incident access) |
| Monday.com | monday | Client ID, Client Secret, Department Restrictions | me:read, boards:read |
| Box | box | Client ID, Client Secret | root_readonly |
| Dropbox | dropbox | Client ID, Client Secret | account_info.read, files.metadata.read, files.content.read |
| DocuSign | docusign | Client ID, Client Secret | signature, impersonation |
6. Zoho Enterprise Suite
Configure credentials in the Zoho Developer Console for your region. All Zoho connectors request baseline identity verification and service-specific access scopes.
| Zoho App | Callback Slug | Admin Fields | Required Scopes |
|---|---|---|---|
| Zoho Mail | zohomail | Client ID, Client Secret, Accounts Host | ZohoMail.accounts.READ, ZohoMail.messages.READ, ZohoMail.messages.CREATE |
| Zoho Calendar | zohocalendar | Client ID, Client Secret, Accounts Host | ZohoCalendar.calendar.READ, ZohoCalendar.event.READ, ZohoCalendar.event.CREATE |
| Zoho CRM | zohocrm | Client ID, Client Secret, Accounts Host, Department Restrictions | ZohoCRM.modules.contacts.READ, ZohoCRM.modules.deals.READ, ZohoCRM.org.READ |
| Zoho Desk | zohodesk | Client ID, Client Secret, Accounts Host | Desk.basic.READ, Desk.tickets.READ |
| Zoho Projects | zohoprojects | Client ID, Client Secret, Accounts Host | ZohoProjects.projects.READ, ZohoProjects.tasks.READ |
| Zoho Books | zohobooks | Client ID, Client Secret, Accounts Host, Department Restrictions | ZohoBooks.contacts.READ, ZohoBooks.invoices.READ |
| Zoho People | zohopeople | Client ID, Client Secret, Accounts Host, Department Restrictions | ZOHOPEOPLE.forms.READ, ZOHOPEOPLE.employee.READ |
| Zoho WorkDrive | zohoworkdrive | Client ID, Client Secret, Accounts Host | WorkDrive.workspace.READ, WorkDrive.files.ALL |
| Zoho Writer | zohowriter | Client ID, Client Secret, Accounts Host | ZohoWriter.document.READ, ZohoWriter.document.ALL |
| Zoho Sheet | zohosheet | Client ID, Client Secret, Accounts Host | ZohoSheet.dataAPI.READ, ZohoSheet.dataAPI.ALL |
| Zoho Show | zohoshow | Client ID, Client Secret, Accounts Host | ZohoShow.presentation.READ, ZohoShow.presentation.ALL |
7. Social Media Platforms
| Platform | Callback Slug | Admin Fields | Required Permissions |
|---|---|---|---|
instagram | Client ID, Client Secret | instagram_business_basic, instagram_business_content_publish | |
| Facebook Pages | facebook | Client ID, Client Secret | pages_show_list, pages_read_engagement, pages_manage_posts |
| X (Twitter) | twitter | Client ID, Client Secret | tweet.read, tweet.write, users.read, offline.access |
linkedin | Client ID, Client Secret | openid, profile, email, w_member_social | |
| TikTok | tiktok | Client ID, Client Secret | user.info.basic, video.publish, video.upload |
Custom APIs & Enterprise Services
Beyond built-in connectors, teams can connect any proprietary internal service, microservice, or custom tool directly by selecting New Custom Connector in the Connections console.
1. Custom Protocol & API Servers
Connect directly to modern remote service endpoints. The agent dynamically discovers available operations and parameters on demand:
- Endpoint URL: The secure base URL of your enterprise service endpoint (e.g.
https://api.internal.company.com). - Authentication Options:
API Key / Bearer Token: Standard static authentication headers.OAuth 2.0: Dynamic authorization flow using your enterprise identity server, routing securely through the shared redirect callback.Internal / Direct: For secure internal network endpoints.
2. OpenAPI & REST Services
- OpenAPI Import: Provide a public or authenticated OpenAPI specification (JSON/YAML URL). Cowork inspects endpoints, parameters, and response schemas to automatically construct callable agent capabilities.
- REST Service Mapping: Configure custom base URLs, HTTP methods (GET, POST, PUT, DELETE), header templates, and JSON payload structures for custom internal microservices.
Database & Data Sources
Connect relational databases and analytics data warehouses to enable Cowork to query data safely, generate live charts, and reconcile financial or operational metrics:
- Supported Engines: PostgreSQL, MySQL, MongoDB, Elasticsearch, Redis, ClickHouse, Snowflake, and Oracle.
- Read-Only Query Protections: All database queries are executed in strictly sandboxed, read-only sessions with automated parameter sanitization to protect data integrity.
- Pre-Flight Connection Verification: To ensure high reliability, Cowork performs a live connection check before saving any database or custom connector configuration.