Skip to main content

​
App connections

A Mind works in the owner’s apps through Composio: Gmail, Google Calendar and Meet, Sheets, Drive, Docs, Notion, Slack, Discord, Outlook, HubSpot and Zoom. The owner connects an app once per account on the Connections page; Composio stores and refreshes the OAuth tokens.
  • Tokens never reach HelloNear’s backend, the browser or the model.
  • The Composio user id is the HelloNear user id, so a Mind’s tools act only on its own owner’s accounts.
  • Actions that change something wait for the owner’s approval. See Skills and tools.
  • Guests get a fixed, fictional sample inbox and calendar instead of a real account.
The full list with what each app is for is on Connectors.

​
A Mind’s own email address

With the email-address skill, a Mind gets its own inbox on AgentMail ({name}-{6 id chars}@agentmail.to), for invoices and replies. Owners can send at most 20 emails per Mind per day.

​
API keys (secrets)

For a website or API the owner wants a Mind to call, the owner stores a key on the Keys page:
  • Each key has a name (UPPER_SNAKE_CASE) and a list of allowed hosts. It is only ever sent to those hosts.
  • It is stored encrypted with AES-256-GCM, bound to the owner and the key’s name (apps/be/src/crypto.ts), and never returned by the API.
  • The model only ever writes {{secrets.NAME}}. The tool fills in the value at execution. Values and wallet tokens live in an in-memory map, so they never reach prompts, traces or stored run snapshots; a test scans every table for them.
  • In events, secrets are shown as ••••.
Through the API: GET /v1/secrets (names and hosts only), PUT /v1/secrets/{NAME}, DELETE /v1/secrets/{NAME}; GET /v1/connections, POST /v1/connections/{toolkit}, DELETE /v1/connections/{toolkit}.