Credential mode
When you share an integration, choose whether the grantee's agents call it with their own authorization or with the Helios app identity. This matters for GitHub and Slack.
Most integrations hold one credential and every agent call uses it. See authentication. Two integrations are different. GitHub on an organization or enterprise install and Slack ask each person to authorize once, so that agent actions carry the right identity.
When you share one of those integrations, the share dialog has a Connects as choice.
| Option | Agent calls use |
|---|---|
| Their own account | The grantee's own per-user authorization. This is the default. |
| The Helios app | The app identity the integration was installed with. |
Their own account
The grantee must complete the per-user authorization for the integration. Until they do, their agents stop with "authorization required" on that integration. Actions in GitHub or Slack are attributed to the person.
Access that comes through a project grant always works this way. Only a grant made directly on the integration carries a mode.
The Helios app
Calls use the app identity. Nobody has to authorize individually. Actions appear as the Helios app or bot. Use this for shared automations where no single person should be the author.
If any live grant that reaches the caller uses the Helios app, directly, through a group, or org-wide, that mode wins over a personal one.
Changing the mode later
The access list on the integration shows the mode on each row, for example "Operator · Helios app". Open the row's role menu to switch Connects as without sharing again.
Service accounts
A service account has no personal GitHub or Slack login. Give it one of these.
- A grant on the integration with Connects as set to The Helios app.
- Act as me on the service account, so it uses your authorization.
Where the choice shows
The dialog shows Connects as for every integration. It only changes behaviour for integrations that require per-user authorization, which today are GitHub and Slack.
Related
- Authentication - per-user authorization.
- GitHub and Slack.
Last updated on
Service accounts
A service account is a non-human identity. Assign it to a workflow with Runs as, share resources with it, and disable it to stop every run that uses it.
Team management
Members are managed in the organization settings that Helios shares with WarpBuild. Invite by email, pick a role, and remove people when they leave.