Consent once
The user decides
Users are prompted to grant consent to the third-party application; access is tied to that consent.
Agentic AI / Connections
Connections
A connection links WebFrolic to a third-party OAuth2 application. Users are prompted to grant consent, WebFrolic stores and refreshes their tokens, and any user you assign the connection to can request an access token for a customer who has already consented.
Available now in WebFrolic.
Why it matters
Agents that act for users need the user’s token, and that is where most designs leak.
An agent booking a meeting or filing a ticket in a third-party system must use the customer’s own access, not a shared admin key. Storing each customer’s refresh token in the agent spreads long-lived credentials everywhere. Connections keep them in the identity provider and hand out short-lived access tokens instead.
Always fresh
Tokens refreshed for you
WebFrolic refreshes stored tokens at regular intervals, so assigned users get a working access token when they ask.
Nothing long-lived exposed
Refresh tokens stay put
Refresh tokens and client ID and secret never leave the identity provider; callers only see access tokens.
How it works
Act on a user’s behalf, safely.
| Step | What happens | Control |
|---|---|---|
| Configure | An administrator creates a connection for the third-party OAuth2 application in Administrator → Connections. | Credentials, access, firewall, usage and audit views per connection. |
| Consent | A customer is prompted to grant consent; WebFrolic stores the resulting tokens. | The customer’s consent defines the access. |
| Assign | The connection is assigned to users of any type, including service and machine users that run agents. | Only assigned users can request tokens. |
| Request | An assigned user requests an access token for a customer whose token is already stored. | Network firewall rules; the refresh token is never returned. |
| Refresh and audit | WebFrolic refreshes tokens on a schedule and records each request. | Usage and audit history per connection. |
Before rollout
Questions worth answering.
Settle these first and the rollout is mostly configuration.
- List the third-party applications agents must call on a user’s behalf.
- Decide which users and agents may request tokens for each connection.
- Set network firewall rules for each connection.
- Plan how customers revoke consent, and what agents do when they have.
- Review usage and audit history for each connection.
Related capabilities
Explore what connects to this.
These capabilities are usually configured together.
Evaluate with your scenario
Start with a concrete workflow.
Share the identities, resource boundary and decision you want to test. The walkthrough can focus on the relevant behavior rather than a generic feature tour.