# Connectors overview

> Connect Endue to a service you already use, bind that connection to specific agents, and revoke it when you are done.

A **connector** links an agent to a service you already use. Endue ships connectors for more than thirty services — see [Available connectors](/docs/connect/available-connectors/).

## Connection versus binding

This is the one idea worth getting right, because it is what keeps an agent's reach predictable.

<Steps>

1. **You authorize a connection.** You sign in at the provider — Google, Slack, Notion — or paste an API token. The resulting connection belongs to *your account*.

2. **You bind the connection to specific agents.** Only agents you bind it to can use it.

</Steps>

Connecting Gmail does not hand your inbox to every agent you own. An agent that has no business reading your email should not be bound to it — that narrows what can go wrong and makes the agent's choices more predictable.

## Connect a service

<Steps>

1. **Open Connectors** in [Agent Builder](/docs/build/agent-builder/), under the agent's Ability section, and pick the service.

2. **Authorize it.**

   Most services send you to the provider to sign in and approve access; Endue receives only the permissions shown on that consent screen. Others ask for an API token you create in the provider's own settings, sometimes together with the address of your own installation.

3. **Bind it to this agent.** The agent's tools for that service appear on its next [run](/docs/work/runs/).

</Steps>

<Aside type="caution" title="Connect the account you mean to use">
  A connection is tied to one account at the provider. If you have both a work and
  a personal Google account, check which one you are signing in as. Connecting the
  same service again with the same account re-authorizes the existing connection
  rather than creating a duplicate, so bindings are preserved.
</Aside>

## What an agent can do once connected

Each connector exposes a set of operations, and every operation is classified by what it does: read, write, send, or destructive. **Send and destructive operations always stop for your [approval](/docs/work/approvals/)** — with the exact arguments shown — before they run.

So a connected Gmail lets an agent search and read freely, draft without asking, and send only with your say-so.

## Revoking

You can disconnect from either side:

- **In Endue**, remove the connection. Every agent bound to it loses those tools immediately.
- **At the provider**, revoke Endue's access in your Google, Slack, or Notion account settings, or delete the API token.

Revoking at the provider leaves the connection in Endue in a broken state until you remove or re-authorize it. See [Troubleshooting connections](/docs/connect/troubleshooting/).

## Limits

- One account per connection, per service. To work with two Google accounts, authorize two connections.
- Connections are bound per agent. There is no "all agents" option.
- A connector exposes a fixed set of operations. It is not a general-purpose API client — an agent cannot call arbitrary endpoints at the provider.
- Endue can only do what the provider's authorization allows. If a scope was not granted, the operation fails at the provider, not silently.

## Related

<CardGrid>
  <LinkCard
    title="Available connectors"
    href="/docs/connect/available-connectors/"
    description="Every service you can connect, and what an agent can do with it."
  />
  <LinkCard
    title="Approvals"
    href="/docs/work/approvals/"
    description="Which operations stop and ask you first."
  />
  <LinkCard
    title="Troubleshooting connections"
    href="/docs/connect/troubleshooting/"
    description="Expired tokens, revoked access, wrong account."
  />
</CardGrid>