> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hellonear.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections and keys

> How a Mind uses your apps through Composio, and how API keys are stored so the model never sees them.

## App connections

A Mind works in the owner's apps through **Composio**: Gmail, Google Calendar and Meet, Sheets, Drive, Docs, Notion, Slack, Discord, Outlook, HubSpot and Zoom. The owner connects an app once per account on the Connections page; Composio stores and refreshes the OAuth tokens.

* Tokens never reach HelloNear's backend, the browser or the model.
* The Composio user id is the HelloNear user id, so a Mind's tools act only on its own owner's accounts.
* Actions that change something wait for the owner's approval. See [Skills and tools](https://docs.hellonear.xyz/skills.md).
* Guests get a fixed, fictional sample inbox and calendar instead of a real account.

The full list with what each app is for is on [Connectors](https://docs.hellonear.xyz/connectors.md).

## A Mind's own email address

With the `email-address` skill, a Mind gets its own inbox on AgentMail (`{name}-{6 id chars}@agentmail.to`), for invoices and replies. Owners can send at most 20 emails per Mind per day.

## API keys (secrets)

For a website or API the owner wants a Mind to call, the owner stores a key on the Keys page:

* Each key has a name (`UPPER_SNAKE_CASE`) and a list of **allowed hosts**. It is only ever sent to those hosts.
* It is stored encrypted with AES-256-GCM, bound to the owner and the key's name (`apps/be/src/crypto.ts`), and never returned by the API.
* The model only ever writes `{{secrets.NAME}}`. The tool fills in the value at execution. Values and wallet tokens live in an in-memory map, so they never reach prompts, traces or stored run snapshots; a test scans every table for them.
* In events, secrets are shown as `••••`.

Through the API: `GET /v1/secrets` (names and hosts only), `PUT /v1/secrets/{NAME}`, `DELETE /v1/secrets/{NAME}`; `GET /v1/connections`, `POST /v1/connections/{toolkit}`, `DELETE /v1/connections/{toolkit}`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.