Connected accounts

#Preview status

Connected accounts are separate from Project Authentication. Project Authentication proves who an application user is; connected accounts hold permission to act on an external resource such as a calendar or messaging workspace.

#Initial project-isolated mode

1. 1
   Resolve an OEM end user

   A project's Memory scope anchors the external connection.

2. 2
   Start one-time authorization

   HALO stores random state and PKCE context; the provider callback remains fixed per project, not per user.

3. 3
   Store encrypted tokens

   Provider access and refresh tokens remain in a server-side vault.

4. 4
   Grant a Service capability

   Runtime execution receives only the scopes approved for that Service, never the provider token itself.

#Portable mode

A later opt-in portable identity can link verified OEM scopes and reuse an existing provider grant across those linked scopes. Email equality alone must never create this link. Missing upstream scopes still require incremental user consent.

#Token custody

#Legacy-service limits

A redirect hook cannot manufacture an upstream API permission. Services such as DoorDash that expose no suitable public OAuth/API contract remain partnership-required catalog entries.