Integration accounts

An integration account gives actions and triggers access to an external service. Automate.ax manages its credentials. Automation code selects a binding, never the secret. Organization admins can use the Connected Accounts page or run bunx automate.ax accounts to connect, inspect, disconnect, and revoke accounts. The command-line tool gets its available services and connection methods from Automate.ax, including providers that the organization hasn’t connected before.

During alpha, Google integrations are available by request. Request access for the Google Account you want to connect.Google permissions let Automate.ax run your configured actions and triggers. Results may be retained in run history, shared with authorized organization members, and sent to the services or AI providers your automation selects. Review those destinations before authorizing. Do not use Google Workspace data for advertising or general-purpose AI model training. Read the privacy policy for data use and deletion.

Use the default account

Account-backed actions and triggers use the service’s default binding unless you select another account. Triggers take account in their configuration object; actions take it in a separate second argument:

const email = gmail.onNewEmail()

gmail.sendEmail({
  to: "person@example.com",
  subject: "Hello",
  text: "Sent with the default Google account binding.",
})

During deployment, the web app asks you to connect or select an eligible Google Account when the binding needs an account. For a service-specific reference to the same binding, call the provider’s account helper without an argument:

import { googleAccount } from "automate.ax/google"

const defaultGoogle = googleAccount()

Use several accounts

Use a stable name when one project needs several accounts for the same service:

const email = gmail.onNewEmail({ account: "support" })

gmail.sendEmail(
  {
    to: email.replyTo.transform(
      (recipients) => recipients[0]?.address ?? "fallback@example.com",
    ),
    subject: "Billing follow-up",
    text: "We received your request.",
  },
  { account: "billing" },
)

The strings support and billing identify deployment bindings. During deployment, assign an authorized Google Account to each one in the web app. Pass --cli-authorization to use the terminal instead. In non-interactive environments, open the focused URL returned by the deploy error and run bunx automate.ax deployment authorize <deployment-id> to resume waiting.

Authorize required permissions

Every account-backed action and trigger declares its permissions. Deployment combines them for each service and binding, then checks the selected account. Missing authorization pauses deployment so you can connect or reauthorize it. Adding an operation that needs broader permissions can therefore require reauthorization on the next deployment.

Choose accounts at deployment or execution

Trigger account selection must be static because Automate.ax configures event sources during deployment.
A single-service action’s second argument can select a literal binding, account reference, or compatible signal because Automate.ax resolves its account during execution. Use .usingAccount(account)(input) to create an immutable bound callable.
An action that accepts multiple services requires a service-specific account reference so Automate.ax knows which provider to authorize during deployment.

Automate.ax rejects an account reference for the wrong service. For example, a Slack account reference can’t satisfy a Gmail action.

Keep provider credentials out of code

Provider credentials never enter automation inputs, signals, deployment manifests, or source code. The runtime resolves the binding, refreshes credentials when necessary, and exposes them only to the integration action. Automate.ax records account choices with each successful deployment. A later deployment can select a different account without rewriting every action that uses the same logical binding. Use Parameters & Accounts in a project’s navigation to review its active bindings. Changing an account reveals Redeploy, which publishes the active project code again with the new account choices.

Manage accounts from the command line

Run the interactive account manager:

bunx automate.ax accounts --org my-organization

Agents and scripts can use the individual commands with --json:

bunx automate.ax accounts services --json
bunx automate.ax accounts list --org my-organization --json
bunx automate.ax accounts show --org my-organization --account intacct_... --json
bunx automate.ax accounts connect --org my-organization --service google --connection-method oauth --no-open --no-wait --json
bunx automate.ax accounts status --org my-organization --flow intflw_... --json

connect prints the provider authorization URL. It opens the browser by default and waits for completion. Use --no-open in a remote environment and --no-wait to save the flow ID and poll it later with accounts status. Credential forms are interactive. Password and API key fields use a masked terminal prompt that sends them directly to Automate.ax. The command-line tool doesn’t accept them as command arguments, environment variables, or JSON, so they don’t enter shell history, process listings, or agent transcripts. Use the Connected Accounts page when no private terminal is available.

Disconnect or revoke

Disconnecting or revoking access does not delete existing run history. To request deletion of your personal information or Google data held by Automate.ax, email info@automate.ax with your account email and the relevant organization or project. Do not include credentials or message contents. We verify your identity and authority, confirm the effect on shared automations, and report completion and any required retention. You can also revoke access in your Google Account connections. Completed history follows run-history retention. Waiting runs retain data needed to continue. Deletion from active database storage does not immediately remove recovery backups. Automated backups normally expire within seven days; manual snapshots need separate review and deletion. We report their deletion schedule or any required retention when handling your request. You control local exports and copies sent to other services. Disconnecting removes an account only from the selected organization. It doesn’t invalidate the provider credential or affect organizations that also use the account. Remove its active project bindings first:

bunx automate.ax accounts disconnect --org my-organization --account intacct_...

Revocation is platform-wide. Automate.ax shows an impact preview before it proceeds, immediately blocks the credential, disables every active automation bound to it, and returns affected in-progress deployments to account authorization. It then revokes the provider credential when the provider supports revocation:

bunx automate.ax accounts revoke --org my-organization --account intacct_...

The preview identifies projects in every linked organization you can access and reports inaccessible organizations only as a count. Organization API keys remain limited to their own organization. Use --yes for a non-interactive revocation after inspecting revocation-impact through the public API. Revocation is idempotent. You can retry it safely when account status reports pending or failed provider cleanup. Connecting a replacement account never re-enables affected automations. Review their bindings, then enable them explicitly.

Start

Concepts

Guides

Use the default account

Use several accounts

Authorize required permissions

Choose accounts at deployment or execution

Keep provider credentials out of code

Manage accounts from the command line

Disconnect or revoke

​Use the default account

​Use several accounts

​Authorize required permissions

​Choose accounts at deployment or execution

​Keep provider credentials out of code

​Manage accounts from the command line

​Disconnect or revoke

Use the default account

Use several accounts

Authorize required permissions

Choose accounts at deployment or execution

Keep provider credentials out of code

Manage accounts from the command line

Disconnect or revoke