# How account linking flows work

> When an agent can offer a link button in chat, when a workspace admin has to act first, and how links target a specific workspace.

Linking an account can start in two places: the workspace's Integrations tab,
or a card a private agent posts in a one to one chat with one tap link
buttons. Both run the same flow; the card just saves you the trip.

## The in-chat link card

A private agent in a one to one chat can post a card with a Link button per
provider. Tapping a button runs the real linking flow for your own account.
The card is only for linking your own accounts, so it never appears in group
chats or from shared agents.

An agent asks for the accounts a job needs before it starts the job, all on
one card, so you can link them while it works. Installing a blueprint works the
same way.

While a card is open, a line above the message box says the agent is waiting
for you to link, with the same Link button and a Dismiss. You can finish the
link on any device. Once it lands, the card shows the account as linked
everywhere the chat is open, and the agent is told straight away, so it carries
on (usually by asking you to approve its access) without you having to ask
again. Dismiss tells the agent to carry on without that account.

## Links target one workspace

Every link lands in a specific workspace, and only that workspace's agents
can ever be granted it. The card can target any workspace you belong to, and
it names its destination. Route by where the account will be used: if you
want an agent in your team workspace to read your Notion, the link must land
in that team workspace, even if you are asking from somewhere else. A
workspace connect (an admin action) does not notify the agent: after one,
tell the agent it is done.

## When a plain member must ask an admin

Some providers need a workspace level connection before members can link
their own accounts:

- Slack: a workspace owner or admin must connect the workspace's Slack first.
  Until then, a plain member cannot link their own Slack account, and the
  unblock is asking an admin. If you are an owner or admin, the same card
  offers you the Connect Slack workspace button directly. See
  [Slack connector](https://bolter.chat/help/connectors/slack).
- Work Google: an admin must complete the Work Google setup for the
  workspace before members can opt in their own work mailbox. See
  [Google connector](https://bolter.chat/help/connectors/google_workspace).

## When the unblock is the Integrations tab, not a card

A few setups are admin wizards that cannot run from a chat card:

- The Work Google setup is a wizard on the workspace's Integrations tab.
  Once it shows Work Google as active, members get the one tap mailbox opt in.
- GitHub is installed by an admin from the Integrations tab or from an
  agent's grant request card; there is no personal GitHub link. See
  [GitHub connector](https://bolter.chat/help/connectors/github_app).
- MCP servers are registered on the Integrations tab, by any member of the
  workspace: from a catalogue entry, or from Connect any MCP server for one the
  catalogue does not list. See [MCP servers](https://bolter.chat/help/connectors/mcp).

## Finishing a link in Bolter

A link only completes for the person who started it. When you approve the
provider's sign in somewhere that is not signed in to Bolter as you, such as
the sign in window in the mobile app, or a browser that is signed out or
signed in to a different Bolter account, Bolter asks you to finish in Bolter.
In the app this happens on its own or with one Return to Bolter tap; in a
browser you may be asked to sign in first. If that browser is signed in to a
different one of your Bolter accounts, choose Use a different account and
sign in as the account you started from. The link must be finished within
ten minutes of starting it.

If someone sends you a link to approve, Bolter refuses it with "This
connection was started from a different Bolter account." Start the link from
your own account instead.

## After linking comes the grant

Linking stores the credential; it gives no agent access by itself. The agent
still requests a credential grant, and you or an admin approve it. See
[Connectors overview](https://bolter.chat/help/connectors/index), and [Connected accounts, credentials, and grants](https://bolter.chat/help/access/connected-accounts-and-grants) for who
approves each kind.

Source: https://bolter.chat/help/connectors/linking-flows