> ## Documentation Index
> Fetch the complete documentation index at: https://docs.joystream.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect a service

> Give a workspace the credentials its agents need, and confirm an agent will resolve the one you intended.

Agents reach outside services using credentials stored in a vault. This guide connects one and verifies it resolves the way you expect.

<Steps>
  <Step title="Find the provider">
    ```bash theme={null}
    jstm connection providers
    jstm connection providers --search slack
    ```
  </Step>

  <Step title="Connect it">
    For an OAuth provider, this opens your browser:

    ```bash theme={null}
    jstm connection add slack --workspace acme-corp/finance
    ```

    On a machine without a browser, print the URL instead:

    ```bash theme={null}
    jstm connection add slack --workspace acme-corp/finance --no-browser
    ```

    For an API-key provider, pass the key:

    ```bash theme={null}
    jstm connection add anthropic --workspace acme-corp/finance --api-key sk-ant-…
    ```

    By default the credential lands in the vault for that workspace. To place it elsewhere — an org vault, so several teams can share it — name the vault:

    ```bash theme={null}
    jstm connection add slack --workspace acme-corp/finance --vault 7ac1d3f5-…
    ```

    <Info>
      Choosing where a credential lives is the main decision here. A workspace vault keeps it to one team. An org vault lets you share it — and then control who gets it with [credential scope](/features/credentials-and-vaults).
    </Info>
  </Step>

  <Step title="Confirm it works">
    ```bash theme={null}
    jstm connection test slack --workspace acme-corp/finance
    ```

    This calls the provider for real, so it catches an expired or revoked token that a listing would still show as present.
  </Step>

  <Step title="Confirm agents will get the right one">
    ```bash theme={null}
    jstm connection resolve slack --workspace acme-corp/finance
    ```

    This prints the tier-by-tier walk — personal, then workspace, then org — and shows what matched where.

    It matters because you can have more than one credential for a provider. If a personal credential shadows the shared team one, agents run as you rather than as the team, and the only place that's visible is this walk.
  </Step>
</Steps>

## Sharing a credential across teams

Put it in the org vault, then scope it:

```bash theme={null}
# Available to every workspace in the org
jstm vault scope 4d90c7e2-… --scope all

# Or restricted to named workspaces
jstm vault scope 4d90c7e2-… --scope selected \
  --workspace acme-corp/finance --workspace acme-corp/revops
```

Only an org owner or admin can scope org credentials. See [Audit and scope org credentials](/guides/audit-and-scope-org-credentials).

## GitHub needs a token for private repos

Signing in with GitHub grants public access only. To read private repositories — for skill sources or MCP repositories — connect a personal access token with the `repo` scope. See [Connect GitHub for private repos](/guides/connect-github-private-repos).

## Removing a connection

```bash theme={null}
jstm connection remove slack --workspace acme-corp/finance
```

If several credentials exist for the provider, the command asks you to name one rather than guessing:

```bash theme={null}
jstm connection remove slack --workspace acme-corp/finance --id 4d90c7e2-…
```

## What agents see

A skill declares the services it requires. At run time, JoyStream resolves a credential for each and hands it to the MCP server in the environment variable that server expects. If a required credential is missing, the run stops and names the provider to connect — it does not guess.

See [Credentials and vaults](/features/credentials-and-vaults) for how the environment variable is chosen.

## See also

* [`jstm connection`](/cli/connection) — full reference.
* [Credential problems](/troubleshooting/credentials)