# Connect an account

> Source: https://elaichi.ai/docs/guides/connections/connecting-an-account/

Authorize a product account so Elaichi can turn its documented methods into tools your agents can run. A **connection** is one authorized account for a product — your Jira, your team’s shared HubSpot, or the company’s Salesforce.

**Where to find it:** **Connections** → **Add connection**

Credentials live in a secure vault and are only used when a tool runs. Elaichi keeps the details around them: which product, who owns the connection, and whether it still works.

## Permissions you need

| Permission | What it allows |
| --- | --- |
| `connection:create` | Connect accounts for **personal** (user) use. |
| `connection:create_shared` | Connect accounts owned by a **team** or the **whole organization**. |
| `connection:manage` | Reconnect or delete any connection in the organization (not required to create your own). |

Members of the built-in **Member** role can create personal connections. Creating team or organization connections needs **Team Admin** or above (or a custom role with `connection:create_shared`).

Administrators can also [restrict connectors](/guides/governance/set-restrictions) per role or member. Restricted connectors are blocked at connect time.

## Ownership scopes

Every connection is owned at one of three scopes. Choose this when you connect — you can [transfer](/guides/connections/transferring-and-offboarding) a personal connection later without signing in again.

```mermaid title="Connection ownership scopes"
flowchart TD
  Connect["Connect an account"] --> Scope{Ownership scope}
  Scope -->|"Personal"| User["Only you"]
  Scope -->|"Team"| Team["Members of one team"]
  Scope -->|"Organization"| Org["Everyone in the org"]
  User --> Tools["Tools run with vaulted credentials"]
  Team --> Tools
  Org --> Tools
```


| Scope (UI label) | Who can use it | Typical use |
| --- | --- | --- |
| **Personal** (`user`) | Only you | Individual accounts; transfer before you leave |
| **Team** (`team`) | Members of one team | Shared inbox, squad CRM, on-call tooling |
| **Organization** (`org`) | Everyone in the organization | Company-wide systems |

Scopes your role can’t create still appear in the picker but are disabled, with a note that your role can’t use that scope. Team scope requires a team — create one under **Members & Roles → Teams** first if the list is empty.

## Connect an account

1. Open **Connections** and choose **Add connection**.
2. Search or filter by category, then select the product.
3. Choose who can use the connection: **Personal**, **Team**, or **Organization**. For **Team**, pick which team.
4. Choose **Connect**. Elaichi opens the product’s authorization flow in an in-app window (OAuth products may open a consent popup inside that window).
5. Sign in with the product and approve the access it requests.

When the flow finishes, you see **Connection added** and the connection appears in the list with status **Active**.

:::callout{type="tip"}
Every **Active** connection automatically gets a **connection toolbox** under **Toolboxes → My toolboxes** (named like “{connection} tools”). You can create an MCP server from it without building a shared toolbox first.
:::

## Status after connect

| Status | Meaning |
| --- | --- |
| **Active** | Ready to use. |
| **Pending** | Authorization hasn’t finished yet. |
| **Needs re-auth** | The product needs you to sign in again (expired or revoked access). Use **Reconnect**. |
| **disconnected** | The underlying account is no longer available. Reconnect or delete. |

Token refresh for working connections happens automatically behind the scenes. You only reconnect when the status asks for it.

## Reconnect

If a connection shows **Needs re-auth** (or you need to refresh access yourself):

1. Open **Connections**.
2. Choose **Reconnect** on the row (inline when status needs re-auth, or from the ⋮ menu).
3. Complete the authorization window again.

Reconnect preserves the same connection record and ownership. Credentials are rebound in place; toolboxes that already use the connection keep working once status returns to **Active**.

You can reconnect a connection you own, or any connection if you have `connection:manage`.

## Good to know

- Browse what a product can do under **Connectors** before you connect — the detail page lists its MCP tools (documented methods). Connecting itself always starts from **Connections → Add connection**.
- You only see connections you own, team connections for teams you belong to, and organization connections — unless you have `connection:manage`, which sees everything.
- Deleting a connection immediately breaks toolboxes and MCP servers that use it. Prefer transfer when someone leaves — see [Transfer and offboard](/guides/connections/transferring-and-offboarding).
- Sharing a toolbox that rides on a personal connection can nudge you to transfer that connection to the organization so teammates aren’t tied to your account.

## Related

- [Manage connections](/guides/connections/manage-connections)
- [Transfer and offboard](/guides/connections/transferring-and-offboarding)
- [Browse connectors](/guides/connectors/browse-connectors)
- [How toolboxes work](/guides/toolboxes/overview)
- [Create an MCP server](/guides/mcp-servers/creating-an-mcp-server)