> ## Documentation Index
> Fetch the complete documentation index at: https://learn.actionist.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Apps, tools and integrations

> Choose and configure the apps a client's agents need, and know exactly which connection steps only the client can finish.

<div className="mxp-hero xc-border">
  <div className="exp-eyebrow mxp-rise">SET IT UP, THEY SWITCH IT ON</div>

  <h2 className="mxp-hero-title mxp-rise" style={{animationDelay:'0.06s'}}>
    You choose the apps. <span style={{background:'linear-gradient(90deg,#24A4FF,#9000FF,#E3008E)',WebkitBackgroundClip:'text',backgroundClip:'text',color:'transparent'}}>The client clicks Connect.</span>
  </h2>

  <p className="mxp-hero-dek mxp-rise" style={{animationDelay:'0.13s'}}>
    With **Allow reseller to manage Apps and MCP** granted, you can browse the catalog, plan every app a client's agents need, and get a connection ready to go. The moment a step needs the client's login or their secret, the control locks. Not because of a missing scope, because it always does. This page shows you exactly where that line sits and how to hand it off cleanly.
  </p>
</div>

<div className="w-full py-10">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">The one thing to internalize</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">Every connect control is locked in a delegated session.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      There is no scope that changes this. It doesn't matter what the client's toggles say.
    </p>
  </div>

  <div style={{display:'flex',gap:'12px',flexWrap:'wrap',alignItems:'center',marginTop:'20px'}}>
    <div className="xrs-lock-ctl">
      <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round">
        <rect x="3" y="11" width="18" height="11" rx="2" />

        <path d="M7 11V7a5 5 0 0 1 10 0v4" />
      </svg>

      Connect
    </div>

    <div className="xrs-lock-ctl">
      <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round">
        <rect x="3" y="11" width="18" height="11" rx="2" />

        <path d="M7 11V7a5 5 0 0 1 10 0v4" />
      </svg>

      Grant access
    </div>

    <div className="xrs-lock-ctl">
      <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.4" strokeLinecap="round" strokeLinejoin="round">
        <rect x="3" y="11" width="18" height="11" rx="2" />

        <path d="M7 11V7a5 5 0 0 1 10 0v4" />
      </svg>

      Install
    </div>
  </div>

  <div className="xrs-lock-tip">
    <strong>Client action required</strong>
    This app requires the client's credentials or authorization to complete installation. Ask the client to install or connect this app directly.
  </div>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'18px'}}>
    The same lock, the same lock icon, and the same tooltip appear on **Connect**, **Reconnect**, **Grant access** (the OAuth scope upgrade), **Recheck**, **Disconnect**, and **Switch to OAuth**. It disables the entire API-key form, input fields included, not just its submit button. It disables the app detail page's **Install** button, **Uninstall**, and the confirm button on the Install plan sheet. If a control finishes a connection or touches a credential, it is locked.
  </p>

  <Warning>
    There is no scope check behind this lock. It fires for **any** active delegated session, full stop. Grant **Allow reseller to manage Apps and MCP** completely and the Connect button still shows the lock icon. The backend agrees independently: every mutating install, connection, and OAuth endpoint rejects delegated sessions outright. This isn't a permission you can be missing, it's a boundary with no toggle on either side.
  </Warning>
</div>

<hr className="xc-divider" />

<div className="w-full py-10 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">The scope</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">What "Allow reseller to manage Apps and MCP" actually gives you.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      The client grants this under the label **Allow reseller to manage Apps and MCP**. Its full description, in the product's own words: "Manage the Apps section, including tools, MCP servers, and app connections that don't require credentials. Installing credential-based apps, connecting OAuth apps, and disabling or modifying anything tied to API keys, OAuth tokens, or other secrets is always off-limits, regardless of this setting."
    </p>
  </div>

  <div className="xrs-two">
    <div className="xrs-two-col can">
      <div className="xrs-two-tag">You can, with this scope granted</div>
      <div className="xrs-two-item">Browse the app catalog, including search, facets, featured, and popular.</div>
      <div className="xrs-two-item">Open any app's detail page and read its full description.</div>
      <div className="xrs-two-item">Read install and subscription state for apps already on the workspace.</div>
      <div className="xrs-two-item">Read the connection list and each connection's health.</div>
      <div className="xrs-two-item">Decide which apps a client's agents actually need.</div>
      <div className="xrs-two-item">Prepare everything around a connection, so the client only has to click through the last step.</div>
    </div>

    <div className="xrs-two-col cant">
      <div className="xrs-two-tag">Always the client, no matter what's granted</div>
      <div className="xrs-two-item">App install</div>
      <div className="xrs-two-item">Install plan</div>
      <div className="xrs-two-item">Configure</div>
      <div className="xrs-two-item">Subscription configure</div>
      <div className="xrs-two-item">Subscription uninstall</div>
      <div className="xrs-two-item">Installed triggers</div>
      <div className="xrs-two-item">Connection delete</div>
      <div className="xrs-two-item">Connection health check</div>
      <div className="xrs-two-item">Connection refresh</div>
      <div className="xrs-two-item">Connection exchange</div>
      <div className="xrs-two-item">OAuth start</div>
      <div className="xrs-two-item">Static credential connections</div>
    </div>
  </div>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'18px'}}>
    Marketplace browsing itself is deliberately never locked, delegated or not. You can always look, compare, and plan. What changes is whether you can act on what you find.
  </p>
</div>

<div className="w-full py-10 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">Inside the nav</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">The Apps section, scope by sub-page.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      The **Apps** nav item itself unlocks with `tools_and_integrations` OR `skills`, either one is enough to see it. Once inside, its three sub-pages each check their own scope.
    </p>
  </div>

  <div>
    | Sub-page    | Scope required           | What you can do there                                                                                                        |
    | ----------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
    | Browse      | `tools_and_integrations` | Browse the catalog, open app detail, read install and subscription state, and prepare a connection for the client to finish. |
    | MCP servers | `tools_and_integrations` | View listed MCP servers and their detail pages. See [MCP servers](#mcp-servers) below for what remains unconfirmed here.     |
    | Skills      | `skills`                 | Browse, add, and maintain skills. Covered in full on [Skills](/resellers/skills).                                            |
  </div>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'18px'}}>
    If a delegated session carries only `skills` and not `tools_and_integrations`, it lands on the Skills sub-page rather than Browse. That's deliberate: Browse needs `tools_and_integrations`, so a `skills`-only session would find it locked. The app routes you to the one page you can actually use instead of opening on a dead end.
  </p>
</div>

<hr className="xc-divider" />

<div className="w-full py-10 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">Plan before you ask</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">Reading the catalog before you commit.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      Every app declares its own connection method, OAuth, an API-key form, or both, so what a connection needs from the client varies app to app. Two sets of signals tell you what's realistic before you request anything: the state chip on an Install plan row, and the badges on an app's detail page. Reading both first means you can batch every request the client needs to act on into one message, instead of dripping requests in one at a time.
    </p>
  </div>

  <div>
    **Install plan state chips**

    | Chip            | What it tells you                                                         |
    | --------------- | ------------------------------------------------------------------------- |
    | "Installed"     | Already added to this workspace. Nothing to request.                      |
    | "Connected"     | Installed with a live connection in place. Ready for the client to use.   |
    | "Update link"   | The existing connection needs refreshing or re-authorizing.               |
    | "Install"       | Nothing set up yet. Installing is the next step.                          |
    | "Connect first" | A connection has to exist before this app can be installed or configured. |
    | "Needs setup"   | Installed or connected, but configuration isn't complete.                 |
    | "Blocked"       | Can't be installed or connected on this workspace right now.              |
    | "Ready"         | Every prerequisite is met.                                                |
  </div>

  <div style={{marginTop:'22px'}}>
    **App detail page badges**

    | Badge               | What it tells you                                                                                                                                                                  |
    | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
    | "Coming soon"       | A veil over the whole page. No connection method works on this deployment yet, so there's nothing to request from the client.                                                      |
    | "Available via MCP" | The app's native install path isn't available, but a verified MCP server covers the same app. Point the client at connecting through MCP instead. See [MCP servers](#mcp-servers). |
    | "Beta"              | Informational only. Doesn't change what you or the client need to do.                                                                                                              |
  </div>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'18px'}}>
    Read these before you write to the client, not after. A five-minute pass through the apps a client's agents need turns into one clear message instead of three follow-ups.
  </p>
</div>

<div className="w-full py-10 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">A narrower boundary</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">MCP servers.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      Be precise about what's actually documented here, because MCP servers work a little differently from apps.
    </p>
  </div>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
    The MCP servers sub-page is gated at the route level by `tools_and_integrations`, the same scope as Browse. What the permission copy itself says is that the scope covers "MCP servers" alongside tools and app connections, as part of the same **Allow reseller to manage Apps and MCP** grant.
  </p>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'14px'}}>
    Beyond that route-level gate, the MCP servers page doesn't carry the same per-action locks the Apps surface does. What that means for any specific action inside a delegated session isn't part of the documented material available here, so this page won't tell you that a reseller can, or can't, complete a particular MCP install on the client's behalf. Treat it as unresolved rather than assuming either way.
  </p>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'14px'}}>
    One thing is confirmed either way: an MCP server that requires its own OAuth authorization follows the same client-only rule as apps do. After it's installed, that server shows a "Needs auth" state until the client completes the consent screen in their own account, at which point it turns connected. If a step needs the client's login, it needs the client, MCP server or app, no exceptions.
  </p>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'14px'}}>
    For the full reference on what MCP servers are and how they're configured, see [MCP servers](/Folders/mcp).
  </p>
</div>

<hr className="xc-divider" />

<div className="w-full py-10 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">The handoff</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">Requesting a connection well.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      The client's side of a connection is short: they sign in to their own account, open the app, click Connect, complete the provider's consent screen in their own browser, and the connection appears. Your job is making sure they know exactly which apps, in one pass.
    </p>
  </div>

  <Steps>
    <Step title="Identify every app the client's agents need">
      Walk the agents you've configured for this client and list every app or MCP server they call. Check each one's state chip and detail badges from the [previous section](#reading-the-catalog-before-you-commit) so you know exactly what's missing.
    </Step>

    <Step title="Batch the requests into one message">
      Send one message covering everything the client needs to act on, not a separate ping per app. A client who connects three apps in one sitting is far more likely to finish than one who gets interrupted three separate times.
    </Step>

    <Step title="Name the exact app and the exact button">
      Tell them precisely where to go and what to click, for example "open Apps, find Salesforce, and click Connect." Vague requests like "please connect your CRM" cost you a follow-up question.
    </Step>

    <Step title="Let them authorize on their side">
      The client signs in, clicks Connect, and completes the provider's consent screen themselves. Nothing here happens inside your delegated session.
    </Step>

    <Step title="Verify from your side">
      Re-open the app or MCP server's detail page in your next delegated session and check its state chip and connection health. Confirm it before you tell the client their agent is ready.
    </Step>
  </Steps>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'22px'}}>
    A short template covers most handoffs. Adjust the app list to what's actually missing for that client.
  </p>

  <div className="mxp-window" style={{marginTop:'16px'}}>
    <div className="mxp-window-bar">
      <span className="mxp-window-dot" />

      <span className="mxp-window-dot" />

      <span className="mxp-window-dot" />

      <span className="mxp-window-title">message draft</span>
    </div>

    <div className="mxp-window-body" style={{minHeight:'auto'}}>
      ```text theme={null}
      Hi [client name],

      I've set up [agent name] and it's ready to go, apart from a couple of
      connections only you can complete. Could you take two minutes to:

      1. Open Apps, find [App one], and click Connect (or Install, if it
         hasn't been added yet). Approve the sign-in screen that follows.
      2. Open Apps, find [App two], and click Connect. Approve the sign-in
         screen that follows.

      That's it, no settings to change beyond that. Once you've clicked
      through both, let me know and I'll confirm everything's linked up
      correctly on my end.

      Thanks,
      [your name]
      ```
    </div>
  </div>
</div>

<hr className="xc-divider" />

<div className="w-full py-10 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">When something looks stuck</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">Troubleshooting connections.</h2>

    <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl">
      A quick index for the signals you'll actually see while reading a client's Apps section from inside a delegated session.
    </p>
  </div>

  <div className="xrs-sym">
    <div className="xrs-sym-row">
      <div className="xrs-sym-q">Connect, Reconnect, Install, or any similar button shows a lock icon and won't respond</div>
      <div className="xrs-sym-a">Working as intended. Every connect and install control is disabled for any active delegated session, regardless of granted scopes. There's no setting to change.</div>
      <span className="xrs-who client">Client</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">"Missing permissions"</div>
      <div className="xrs-sym-a">The connected account no longer grants everything the app needs. The client has to reconnect and re-approve the full permission set.</div>
      <span className="xrs-who client">Client</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">"Expired — reconnect"</div>
      <div className="xrs-sym-a">The provider's authorization token has expired. The client needs to reconnect from their own session.</div>
      <span className="xrs-who client">Client</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">"Reconnect needed"</div>
      <div className="xrs-sym-a">A general prompt that the connection needs attention before it will work again. Same fix as above: the client reconnects.</div>
      <span className="xrs-who client">Client</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">"API key needs attention"</div>
      <div className="xrs-sym-a">The stored key is being rejected by the provider. Only the client can open the API-key form and paste a fresh one, the whole form is locked for you.</div>
      <span className="xrs-who client">Client</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">"Not connected"</div>
      <div className="xrs-sym-a">The app has never been linked. Send the client a request naming the exact app and button, per the [handoff steps](#requesting-a-connection-well) above.</div>
      <span className="xrs-who client">Client</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">"Coming soon" veil on an app's detail page</div>
      <div className="xrs-sym-a">No connection method works on this deployment yet. There's nothing for you or the client to configure. Check whether a verified MCP server covers the same app instead.</div>
      <span className="xrs-who support">Support</span>
    </div>

    <div className="xrs-sym-row">
      <div className="xrs-sym-q">A connection keeps expiring and needing reconnection</div>
      <div className="xrs-sym-a">Usually a short-lived provider token. Ask the client to reconnect first. If it recurs often for the same app, that's worth flagging to Actionist support rather than repeating the same request.</div>
      <span className="xrs-who support">Support</span>
    </div>
  </div>

  <p className="text-base text-gray-600 dark:text-gray-400 max-w-3xl" style={{marginTop:'18px'}}>
    For issues that go beyond the Apps section, see the full [Troubleshooting](/resellers/troubleshooting) index.
  </p>
</div>

<hr className="xc-divider" />

<div className="w-full py-10">
  <div className="actionist-cta-panel xc-border">
    <div className="relative z-10 flex flex-col items-center gap-5 max-w-2xl mx-auto">
      <span className="actionist-eyebrow">Apps and MCP</span>

      <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-white leading-tight">
        Plan it fully. Hand off cleanly.
      </h2>

      <p className="text-base md:text-lg text-white/85">
        Everything short of the client's own login and secrets is yours to configure.
      </p>

      <div className="flex flex-wrap items-center justify-center gap-3 pt-2">
        <a className="actionist-cta-btn-primary" href="https://app.actionist.ai" target="_blank" rel="noreferrer">
          Open the Dashboard

          <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2.2" strokeLinecap="round" strokeLinejoin="round">
            <path d="M5 12h14" />

            <path d="m12 5 7 7-7 7" />
          </svg>
        </a>

        <a className="actionist-cta-btn-secondary" href="https://actionist.ai/partners/" target="_blank" rel="noreferrer">
          Signup as a Partner
        </a>
      </div>
    </div>
  </div>
</div>

<div className="w-full pt-2 pb-6">
  <p className="actionist-trust-line">
    Every connect, install, and credential control locks for any active delegated session, no scope changes that.<br />
    Marketplace browsing stays open the whole time · so does everything short of the client's login.
  </p>
</div>

<div className="w-full pb-16 xc-rise">
  <div className="actionist-tight flex flex-col gap-2 mb-6">
    <span className="actionist-section-eyebrow">Keep going</span>
    <h2 className="text-2xl md:text-3xl font-semibold tracking-tight text-gray-900 dark:text-gray-50">Next steps.</h2>
  </div>

  <Columns cols={4}>
    <Card title="Credentials and API keys" icon="key" href="/resellers/credentials">
      Why secrets stay permanently out of reach, and how the hard limit differs from this page's lock.
    </Card>

    <Card title="Full app catalog" icon="layout-grid" href="/apps">
      Browse every app Actionist supports, outside the reseller context.
    </Card>

    <Card title="MCP servers" icon="server" href="/Folders/mcp">
      The full reference for MCP servers, how they're configured, and what authorization they need.
    </Card>

    <Card title="Skills" icon="puzzle" href="/resellers/skills">
      Choosing, adding, and maintaining the reusable task packs an agent loads on demand.
    </Card>
  </Columns>
</div>