# Connectors, accounts, and access

Connector Central separates three decisions: which connector a workspace enables, which connected account supplies the provider credential, and which person, group, or API key may use it. Admins and owners manage these controls from **Connectors** under **Gateway**.

Groups and API keys are included in the Growth and Enterprise plans. See [pricing](/pricing).

## The connector details page

Open a connector to see five tabs:

| Tab | What it shows |
|---|---|
| Overview | Setup progress, connected-account health, access coverage, available tools, and recent activity |
| Connected accounts | Every account connected to this connector, its status, last check, recent call count, and reconnect or disconnect controls |
| Access | People, groups, and API keys that can call the connector, their access levels, and the connected accounts they can reach |
| Tools | The live tool names and input schemas known to Connector Central, including the access level required by each tool |
| Activity | Recent calls for this connector, with actor, connected account, outcome, timing, and error metadata |

Tool availability is evaluated from live workspace state. The Connectors page in your workspace lists every connector available to you. The authenticated `tools/list` response shows the tools available to a caller.

## Enable a connector and connect accounts

1. Open **Connectors** under **Gateway** and choose a connector.
2. Enable it or start its connection flow. Depending on the connector, an admin may enter a credential once or complete browser authorization.
3. Complete verification. A credential-based connector is not ready until it has at least one active connected account.
4. Open **Connected accounts** to review status and presentation labels. Credentials remain encrypted on the server and are never returned to an AI client.

A connector can have more than one connected account. If several accounts are eligible for a tool call, the caller must select one; Connector Central does not silently choose an older account. Disconnecting an account stops new calls through it immediately while retaining historical activity labels.

## Grant access to a person or group

Open the connector's **Access** tab and select **Grant access**. Choose a person or a group. Every new grant starts with **Read**. **Write** and **Destructive** are independent opt-ins; destructive access does not automatically include ordinary write access.

Workspace roles and connector access are separate:

- Users and admins need an active direct or group grant to use a connector. Being an admin permits management but does not automatically expose its tools.
- An owner has all three levels for an enabled connector by default. A direct grant on an owner is shown as a restriction and replaces that implicit access with exactly the selected levels.
- A direct grant on a non-owner takes precedence over group grants, even when it is narrower. Without a direct grant, the most capable active group grant supplies the access level.

Changes apply to the next tool listing or call; existing access tokens do not preserve old grants.

## Grant access to an API key

The same **Access** tab can grant an API key access to the connector. A key has no access simply because its creator can use the connector: it needs its own connector row. New key access starts read-only, and Write and Destructive are configured independently for each connector.

The same key can therefore be read-only on one connector and have a different level on another. Removing a connector from the key stops that key from calling it without changing the key's access to other connectors.

See [API keys](/docs/api/api-keys) for creation, authentication, storage, and revocation.

## Control connected-account reach

A person, group, or API key with connector access initially reaches every current and future active connected account for that connector. Use its access drawer to block accounts it must not reach. Review account reach whenever you add a connected account, because new accounts are allowed by default.

For a member, account blocks are deny-wins. Their own blocks and blocks from every qualifying group are combined, so a direct grant cannot reopen an account blocked through a group. Owners always reach every active connected account; an owner restriction narrows access levels, not account reach. An API key uses only its own connector-specific account blocks.

At call time Connector Central requires all of the following:

- the connector is enabled;
- the caller has the tool's required access level;
- the connected account is active and not blocked for that caller; and
- the requested tool and arguments match the current reviewed schema.

## Review and revoke access

The **Access** tab shows each subject, the source of its access, its levels, who granted it, and any account restrictions. Admins and owners can change levels, change account reach, or revoke access. Revoking a person's or group's grant takes effect on the next request. Removing a key's connector access has the same immediate effect for that key.

## Activity and audit trail

The connector's **Activity** tab is the focused audit trail for its MCP requests. It shows operational metadata such as the actor, tool, connected-account presentation, outcome, duration, and error category. The workspace-wide [Activity log](/docs/connectors-and-access/activity-log) provides the same metadata across connectors and supports filters and request-ID search.

Connector Central does not store prompts, tool arguments, tool results, upstream payloads, or credentials in Activity. Connected-account presentation is retained with historical rows, so disconnecting an account does not erase which connection handled an earlier call.

## Next steps

- [Use groups](/docs/team-and-collaboration/using-groups)
- [Create and secure API keys](/docs/api/api-keys)
- [Review the MCP server reference](/docs/api/mcp)
- [Review workspace activity](/docs/connectors-and-access/activity-log)