An application is something you have connected: a Google account, a search key,
a scraper. It belongs to you, not to any one assistant, and it is the thing a
[client](/docs/tools/assistants) is given permission to reach.

<figure>
  <a href="/docs/tools/applications.png"><picture>
    <source srcset="/docs/tools/applications-dark.png" media="(prefers-color-scheme: dark)">
    <img src="/docs/tools/applications.png" alt="The Applications page. Installed: three Google accounts, each showing email and calendar, plus Exa and Firecrawl marked Included. Below, Available: Google with Sign in and Install, and Perplexity marked Included.">
  </picture></a>
  <figcaption><strong>Installed above, available below.</strong> Anything marked Included comes with your plan, so there is no key to find and nothing to sign up for.</figcaption>
</figure>

## The two kinds

**Accounts you sign into.** Google, today. You sign in once, we hold the token,
and it appears here. Connect as many as you have: a work account and a personal
one are two applications, with separate permissions and separate limits.

**Keys we provide.** Web search, scraping, research. Marked **Included**. Use is
metered against your credits and shows in the [activity log](/docs/tools/activity).

You can also bring your own key for these if you would rather pay the vendor
directly. Install it here and it takes the place of ours.

## Installing one

Open **Applications**, find it under **Available**, and hit **Install**. An
account signs you in with the vendor; a key asks you to paste it once.

Installing an application does not give anything access to it. A client reaches
it only after you [add it to that client](/docs/tools/permissions) and pick a
level.

## Where the keys live

On our servers. An assistant never receives your token, and neither does the
agent inside your workspace. Every call is brokered: the connection asks us, we
check what that client is allowed to do, we make the call, and we hand back the
result.

That is what makes the switches real. If a permission could be bypassed by an
assistant holding your key directly, the setting would be decoration.

## Removing one

Open the application and disconnect it. Every client that reached through it
stops immediately, and the calls it already made stay on the record.