# Connect an integration

> Authorize an outside service with 1-click OAuth or an API key so your agents can act on your behalf.

Every workflow needs credentials. Use **1-click OAuth** for the popular services in our catalog, or an **API key** for everything else.

## OAuth vs API key

- **OAuth** is per-user and refreshes automatically. Use it whenever available.
- **API keys** are service-account style. Use them when OAuth is not an option.

<Callout type="tip">
  When in doubt, OAuth. You can switch to API keys later if needed.
</Callout>

## 1-click OAuth

<Steps>
  <Step>
    Open **Integrations** from the sidebar and search for the service.
  </Step>
  <Step>Click **Connect**, sign in, and approve the requested scopes.</Step>
  <Step>The credential is saved and ready to use in any workflow.</Step>
</Steps>

<Callout type="tip">
  Rename the credential if you plan to connect multiple accounts of the same
  service.
</Callout>

## API key

<Steps>
  <Step>
    Find the service on the **Integrations** page. Non-OAuth services show an
    API key form.
  </Step>
  <Step>
    Generate a key in the provider's console, paste it into our form, and click
    **Save**.
  </Step>
</Steps>

<Callout type="warning">
  Treat API keys like passwords. Rotate them periodically and revoke from
  General Input when you rotate the source.
</Callout>

## Share with your team

<Steps>
  <Step>Open the credential and click **Share**.</Step>
  <Step>
    Share with the whole workspace, specific people, or keep it private.
  </Step>
</Steps>

<Callout type="note">
  When a workflow uses a shared credential, the workflow runs as the
  credential's owner, not the workflow's runner.
</Callout>