Skip to main content
Connections give Righthands access to external systems, so the provider’s authorization and Righthand’s own permissions both matter.

​
Credential handling

Connection credentials—including OAuth tokens, API keys, and custom MCP authentication headers—are encrypted at rest. Data sent between your browser, Righthand, and connected services is encrypted in transit. Hosted authorization is preferred when available. It lets the provider issue a token without exposing the account password to a Righthand. Custom MCP credentials are verified against the server and stored encrypted; they are not displayed to the Righthand.

​
Layered controls

1

Limit the provider account

At the provider, grant only the workspaces, repositories, folders, or records the Righthand needs.
2

Choose connection scope

Set the connection to Personal, Righthand, or Team based on who owns it and who should be able to grant access.
3

Choose Righthand access

Assign only the Righthands that need the connection.
4

Configure tools

Set supported tools to Yes, Ask, or No. Prefer Ask for consequential write actions unless the Righthand has clear standing authority.
5

Test with a read action

Verify a new connection with a small, reversible request before allowing broader work.
See Connection Permissions for the detailed behavior of scope, assignments, and tools.

​
Revoking access

Removing or deleting a connection in Righthand stops Righthand from using that connection. It may not revoke the underlying provider token or end provider sessions. For complete revocation:
  1. Remove or delete the connection in Connections.
  2. Revoke the app authorization, token, or key in the provider’s security settings.
  3. Rotate any shared credential that may have been exposed elsewhere.
  4. Review recent provider activity and Righthand Activity.
Never send passwords, access tokens, API keys, or recovery codes to a Righthand through text, email, Slack, or a task description. Use the connection setup controls.