Keep tokens out
of the agent runtime.
CybrLink separates user authorization from agent execution, so your agents can use tools without directly holding long-lived OAuth credentials.
Your AI agents need access to user apps. They do not need to hold user credentials.
- Private by design
- Use a credential layer you control instead of handing credentials to the agent runtime.
- Scoped access
- Connections are tied to users, integrations, and permissions so agents operate with explicit authorization.
- Revocation path
- Users can disconnect an app, and the system can revoke that connection instead of leaving stale access behind.
- Inspectable architecture
- CybrLink is built around auditable OAuth primitives, making the token path easier to reason about and operate.
Architecture in one diagram
CybrLink coordinates authorization and connection state. Durable OAuth tokens stay inside the highlighted credential layer, where your team controls deployment, storage, and provider credentials.
Frequently asked
Who holds the OAuth tokens?+
Your controlled credential layer is the token store. CybrLink starts and manages the connect flow, but the long-lived OAuth tokens belong in infrastructure you control.
What's the blast radius if CybrLink is compromised?+
The goal is to keep durable credentials out of the CybrLink control path. A compromised control layer should not expose historical OAuth tokens already stored in your credential deployment.
What does self-hosted mean here?+
It means token storage and provider credentials are handled by a credential service you deploy or control. CybrLink currently supports Nango for that layer and keeps required third-party notices on the legal page.
What goes into the audit log?+
Connection events should include the end user, integration key, requested scopes, request id, and outcome. That gives teams a reviewable history of what each agent could access.
Can users revoke access?+
Yes. Connections are visible per user and per integration, and disconnecting an app revokes that connection instead of leaving stale access behind.