Auth and tools

Scale auth and tools
for hundreds of users, at a time.

A walkthrough. Then a live demo.

Saif Ali Shaik Founding DX Engineer · Scalekit

The frame

Auth for apps, and auth for agents.

Incoming Auth for MCP and SaaS apps.

Who can log in, and what can they do?

Login / signup Sessions SSO 2FA RBAC

Outgoing · this talk Auth and connectors for agents.

What can the agent do, on whose behalf?

Delegated OAuth Token refresh Connected accounts Tool calls as the user

You have already seen this

Von. Linear.
A chat. Then work happens.

A live agent acting as a real user — not a service account.

02 · The problem

Every tool call carries two questions.

tool call two questions

Who is calling Authentication

Proving an identity.

Usually answered

What can they do Authorization

Scoping the permission.

The hard part

Per-user credential

Scope enforcement

Audit

Most setups answer who. Few enforce what.

03 · The cost

The m × n problem

Share one account and anyone reads anyone’s data. Scope it per user, and the credentials explode.

The shortcut

One shared account

A

B

C

SERVICE ACCOUNT scope: everything

Authenticated, never authorized

Scoped correctly

One credential per user, per tool

A

B

C

+47

m = 50

×

N

SL

SF

+97

n = 100

=

5,000 credentials

Issued, stored, and refreshed, per user, per provider

An open door or a full-time credential job. Neither ships an agent.

How we got here · 1

First came the inference API.

A manager asked. A teammate shipped it. Months ago, people started sending prompts to an LLM.

Prompt Your team

api

Inference LLM

tokens

Output Text

How we got here · 2

Then the script started to decide.

agent = LLM + harness

harness = tools + loop + state

An agent is a model inside a loop. The harness lets it call tools and keep state.

How we got here · 3

Some of those agents already work.

Engineering Top repositories

Show the repos that moved this week.

Sales The sales report

Summarize the pipeline for the standup.

Support Where time goes

See which tickets eat the week.

One shared key is enough here. A demo. A dashboard. Not a user.

How we got here · 4

Then they want their apps
in your agent.

Not your HubSpot. Theirs. GitHub. Slack. Linear. The tools they already live in.

HubSpot

GitHub

Slack

Linear

Salesforce

Jira

Gmail

Notion

That is when auth and tools must scale. scalekit.com/connectors

Customer story · Z47

WhatsApp + OpenClaw + Scalekit

Every agent runs in its own per-user sandbox. Scalekit owns identity, the credential vault, and every tool call. The sandbox never sees a real token.

Message-to-action flow

1 Message

WhatsApp

Team chat

Team member sends message

2 Route + isolate

OpenClaw

Router

Looks up phone number
Routes to user sandbox
Spins one up if missing
Passes message in

3 Call w/ client ID

Sandbox

Per employee

Holds client ID only
No tokens or secrets stored
Calls Scalekit SDK

4 Resolve + execute

Scalekit

Identity + execution

Resolves user identity
Fetches scoped token
Executes tool call
Returns result to agent
Logs audit event
Enforces rate limits

5 Connected services

Notion

Gmail OOutlook AAttio AfAffinity BBrave GGranola PPhantombuster

+ 20 more

The hard way

You can write the OAuth yourself.

01Register each app. Slack is not GitHub.

02HTTPS callback. localhost will not do.

03Encrypt the store. Key it by user.

04Refresh every token before it dies.

05Never let a token reach the model.

Then do it again for every app, and every user. I wrote the handbook. It is not short. freecodecamp.org/news/ai-agent-per-user-oauth-slack-github

04 · The solution

One layer for auth and tools.
It holds when you add users.

What it does

Delegated OAuth. Per-user actions.

ACTIVE

YOUR AGENT

Notion

Read a page

user token

Database

Create a row

user token

Slack

Send a message

user token

Salesforce

Pull a record

user token

05 · Runtime · Next builds it

One connector. Many connections. Many accounts.

Next adds a piece · 0 / 6

05 · Runtime architecture

One connector → many connections → many accounts.

Configure a connection once. Every user who authorizes gets their own connected account.

# Connector 1 → many Connection 1 → many Connected account

Example 1 One connection. Two people authorize independently.

# Slack Slack OAuth

Alice's Slack Bob's Slack

Example 2 Richer case Two connections, two auth methods.

# Zendesk Zendesk API Key Zendesk OAuth Megacorp Zendesk Mark's Zendesk John's Zendesk

Same connector, two auth methods. That is why connection is its own primitive.

06 · Your stack

Bring your own connectors & tools.

Built-in tools LLM-ready tools.

No token refresh logic. No auth plumbing. Scalekit injects the user’s credentials at runtime.

send_slack_message github_pull_request_get

agent.call(
  send_slack_message(channel, text)
)

Custom tools API proxy mode.

Design the tool around the agent’s intent. Your code. Your contract.

Raw API

POST /v3/tickets
{"queue_id": 42, "fields": {…}}

Wrapped tool

create_ticket(queue, summary)

Bring your own connector Any system, any auth.

Any SaaS API, internal system, or remote MCP server.

SaaS API Internal system Remote MCP

register_connector(
  url, auth, schema
)

OAuth Bearer API key Basic

06 · Tool call · Next builds it

Scalekit injects the user’s credentials at runtime.

Next adds a piece · 0 / 6

The app

This is the app.

We open it after the three calls.

Open the app →

In code · 1 of 3 · create the account

connectionName must match the dashboard.

// docs.scalekit.com/agentkit/quickstart
const { connectedAccount } = await actions.getOrCreateConnectedAccount({
  connectionName: 'github-connect',
  identifier: 'user_123',
});

New Scalekit environments already have a GitHub connection named github-connect.

In code · 2 of 3 · user says yes

Do not call tools until status is ACTIVE.

if (connectedAccount.status !== ConnectorStatus.ACTIVE) {
  const { link } = await actions.getAuthorizationLink({
    connectionName: 'github-connect',
    identifier: 'user_123',
  });
  // redirect the user to link, then resume
}

Scalekit stores the tokens. You store only the user identifier.

In code · 3 of 3 · fetch the PR

There is no summarize tool. There is a get tool.

const result = await actions.executeTool({
  toolName: 'github_pull_request_get',
  identifier: 'user_123',
  connector: 'github-connect',
  toolInput: { owner: 'acme', repo: 'app', pull_number: 42 },
});
// result.data is the PR. Your model writes the summary.

Real tool name from docs.scalekit.com/agentkit/connectors/github

What the agent does next

Scalekit returns the PR.
Your model writes the summary.

Optional next call: github_pull_request_files_list.

07 · Scoping

Scope tools that the agent can reach.

Not just what it is allowed to do.

The gap Standard MCP server

An inbox-summarizer agent needs one capability: fetch mail.

It gets all 30 tools on the server: send, delete, label, manage filters, manipulate threads.

fetch_mails send_mail delete_mail manage_filters manage_threads +25 more

The fix Virtual MCP Server

A Config exposes exactly what is needed: gmail_fetch_mails.

Nothing else is reachable.

gmail_fetch_mails

30 tools × ~200 tokens ≈ 6,000 tokens burned before the agent does anything. Scoped to the 1 tool it needs, that drops to ~200 tokens.

~97% cut

Live

Today we ship it.

Sign in with GitHub. Fetch a PR. Summarize it.

Open the app →

Then the dashboard

You will see the connected account.

The approved identity. The tool calls. The proof.

The point

You build the agent.
Scale the auth and the tools.

Saif Ali Shaik · Founding DX Engineer, Scalekit

Join the agents in production community

Our Luma

Where agent builders show up

luma.com/scalekitinc linkedin.com/in/saif-shines

Scale auth and tools for hundreds of users, at a time.

Auth for apps, and auth for agents.

Von. Linear.A chat. Then work happens.

Every tool call carries two questions.

The m × n problem

One shared account

One credential per user, per tool

First came the inference API.

Then the script started to decide.

Some of those agents already work.

Then they want their apps in your agent.

WhatsApp + OpenClaw + Scalekit

You can write the OAuth yourself.

One layer for auth and tools. It holds when you add users.

Delegated OAuth. Per-user actions.

One connector. Many connections. Many accounts.

One connector → many connections → many accounts.

Bring your own connectors & tools.

Scalekit injects the user’s credentials at runtime.

This is the app.

connectionName must match the dashboard.

Do not call tools until status is ACTIVE.

There is no summarize tool. There is a get tool.

Scalekit returns the PR.Your model writes the summary.

Scope tools that the agent can reach.

Today we ship it.

You will see the connected account.

You build the agent. Scale the auth and the tools.

Our Luma

Scale auth and tools
for hundreds of users, at a time.

Von. Linear.
A chat. Then work happens.

Then they want their apps
in your agent.

One layer for auth and tools.
It holds when you add users.

Scalekit returns the PR.
Your model writes the summary.

You build the agent.
Scale the auth and the tools.