Connect Services from AI Chat Without Sharing Credentials

AI assistants can do more than answer questions. When connected to business platforms, they can build apps, set up workflows, and connect to systems such as CRMs, ERPs, email services, and databases.

But to work with a service, the assistant often needs a connection to it. That raises an important question: how do you connect a service without typing passwords, API keys, or tokens into a chat?

The answer is a secure connection flow. Instead of collecting credentials in the conversation, the assistant hands the sign-in step to the platform itself. You sign in there, the connection is saved and tested, and the assistant continues its work once the connection is ready.

Why Credentials Don’t Belong in the Chat

Pasting credentials into a chat may seem convenient, but it creates real risks.

Credentials shared in a chat can:

• Be stored in the conversation history
• Be visible to anyone with access to the conversation
• Be copied, forwarded, or exported with the chat
• Be handled by systems that were never meant to store secrets
• Be hard to track or revoke once they’ve been shared

For example, an API key pasted into a chat to connect a CRM might remain in the conversation long after the project is finished, where it could be found and misused.

A secure approach keeps credentials out of the conversation entirely.

How a Secure Connection Flow Works

A secure connection flow separates the conversation from the sign-in:

1. The assistant notices that a service it needs isn’t connected yet.
2. It shows a connect card in the chat instead of asking for credentials.
3. The user opens the platform’s own setup form, either inside the chat or in a browser.
4. The user signs in, tests the connection, and saves it in the platform.
5. The assistant checks the connection status and continues once it’s ready.

The assistant never sees the password, API key, or token. It only learns whether the connection is ready to use.

Signing In Where It’s Safe

The sign-in step always happens in the platform that owns the connection, not in the chat itself.

Depending on the AI assistant, this can happen in two ways:

• Embedded in the chat, when the assistant’s interface allows the platform’s setup form to appear inside the connect card
• In the browser, through a link that opens the setup form in a new window

Opening the form in a browser is always available as a fallback. Some AI assistants block embedded forms, and some services use OAuth sign-in, which may open a separate browser window to complete the process.

Waiting for the Connection, Then Continuing

One of the biggest advantages of a secure connection flow is that the work doesn’t stop.

Without it, an assistant can only share a link to add a connection and then wait for the user to come back and say it’s done. With a secure flow, the assistant can check the status itself and continue as soon as the connection passes its test.

For example, while building a workflow that sends new leads to a CRM, the assistant may find that the CRM isn’t connected. It shows a connect card, the user signs in and saves the connection, and the assistant then picks up where it left off and finishes building the workflow.

If the connection is saved but fails its test, it needs to be fixed and tested in the platform before the work continues.

Pasting Credentials vs. a Secure Connection Flow

Good Practices for Secure Connections

A well-designed connection flow also includes a few safeguards:

• Never ask for passwords, API keys, or tokens in the chat
• Test each new connection before it’s used
• Don’t change default connections unless the user asks
• Let pending connection requests expire after a set time
• Allow users to cancel a request that’s still pending
• Prevent duplicate connections if the same form is saved twice

Faster Building, Stronger Security

Connecting services is often one of the first steps in building with an AI assistant. It shouldn’t be the step that puts credentials at risk.

With a secure connection flow, users sign in where it’s safe, credentials stay protected, and the assistant can continue building as soon as the connection is ready.

Because the best connections are the ones that never put your credentials in the conversation.