Space Connections

Connection type and Space access are separate decisions:

• Connection type determines whose permissions the configured account uses.
• Space access determines where that connection is available in Type.

Personal connections

A personal connection uses one person’s account. Type can access only what that person can access in the connected app.

This works well for email, calendars, personal documents, source control, and other tools where each person has distinct permissions. Personal connections are also the natural fit for Sidekick.

Mixpanel

Mixpanel connects as a personal account through OAuth and currently supports projects in Mixpanel’s US data region. Choose Mixpanel from Connections or an agent’s connection recommendation, then authorize the account whose projects you want Type to use.

Finish authorization in the same browser that started it, within ten minutes. If the attempt expires or browser cookies are blocked, start Connect again. Reconnecting updates the selected connection; adding another connection keeps the existing one.

After connecting, assign it to the Spaces that need its analytics. An empty project can list Mixpanel’s built-in session events without containing tracked product events.

Organization connections

An organization connection uses shared company access. This works well for CRMs, support platforms, warehouses, shared repositories, and other business systems.

For example, your workspace might configure one HubSpot connection for shared CRM data, then add it to the Sales and Marketing Spaces.

GitHub connections

A Space can use multiple GitHub connections, including repositories from different owners. Add each connection in the Space’s Settings → Connections.

Choose a Default repository for requests that do not name a repository. Changing the default keeps the other GitHub connections attached to the Space. To work with another repository, include its full owner/repository name in your request; an explicit repository takes precedence over the default.

Use a connection in a scheduled automation

Explicit automation account selection is available only to organizations in the rollout. Existing choices remain enforced if the switch is later disabled.

Open the automation’s Settings → Runs as to choose an account. Editors can select authorized team accounts; a personal account must belong to the human the automation runs on behalf of. The menu explains any missing access and offers Allow in [Space] and use when you can approve it. Save the automation to apply the account and approved access changes together. Account selection does not change the Space’s default repository, transfer execution ownership, or disconnect another account.

If a selected account becomes unavailable, the automation lists it under Needs attention. Select Fix to sign in again, choose an eligible replacement, or connect another account. Personal sign-in requires the account owner; team sign-in requires a connection manager or workspace admin with destination access. Paused automations remain paused. With the reconnect rollout enabled, disconnecting clears credentials while retaining the identity needed for repair. Vault managers can restore retained shared vault credentials in Settings → Browser → Team vaults before completing the automation repair. See Fix an unavailable account for the full workflow and account-selection rules.

Author pull requests with your own account

Each teammate can authorize their own GitHub account on an existing team connection:

1. Open Connections and select the GitHub connection used by your Space.
2. Under Your GitHub account, select Connect my GitHub account.
3. Sign in to GitHub with your own account and authorize access.
4. Return to Type and request the pull request from your own Type account.

Personal authorization belongs to you and preserves the team’s repository settings. Your GitHub account must have access to the existing GitHub App installation and the target repository. Type uses your personal authorization for your requests when it can access the repository; otherwise, it can use the GitHub App, so the pull request may be authored by the app.

If personal authorization expires or is revoked, select Reconnect my GitHub account on the same connection.

Custom MCP OAuth

Connect an MCP service

An MCP connection lets Type use tools from another service. Custom MCP must be enabled for your workspace.

1. Open Connections.
2. Select Custom MCP.
3. Enter a name for the connection.
4. Paste the MCP server URL from your service.
5. Select the authentication method specified by the service.
6. Choose a personal or shared connection.

Only you can use a personal connection. Workspace members can use a shared connection if its access settings allow it.

The server must be publicly accessible over HTTPS. Type supports Streamable HTTP servers.

Sign in with OAuth

1. Select OAuth under Authentication.
2. Leave Manual sign-in setup blank unless your service administrator gave you connection details.
3. Select Sign in.
4. Sign in to the service in the window that opens.
5. Approve the access you want to give Type.
6. Return to Type.
7. Select Test connection.
8. Review the available tools.
9. Select Connect with these tools.

Sign-in alone does not save the connection. You must test it and review its tools first.

Type can set up sign-in automatically for supported services. You still sign in to your account and approve access. Automatic setup does not make your account data public.

If Type cannot set up sign-in, ask the service administrator for help with Manual sign-in setup. They must register the exact Redirect URI shown in Type. They must also give you a Client ID and, if required, a Client secret.

To show the Redirect URI, select Sign in. You can then copy it from Manual sign-in setup.

Connect with a token or custom header

Use the authentication method and access details specified by your service.

For Bearer token, enter the token from your service. For Custom header, enter the header name and secret value from your service.

Select No authentication only if the server does not require access details.

After you enter the details, test the connection and review its tools before you select Connect with these tools.

Update a connection

Open the connection’s settings to change its server URL or access details. Test the connection again after a change. Review its tools before you save.

To get the latest tools, select Refresh tools. Review the tools before you save the connection.

To switch between a personal and a shared connection, create a new connection.

If access stops working

Type tries to renew expired access automatically. If Type asks you to sign in again, open the connection and select Sign in again.

A permission error means the account cannot perform the requested action. Another sign-in might not fix this. Ask the service administrator to check the account’s permissions.

If an action fails after it starts, it might still have completed. Check the connected service before you retry. A retry can repeat the action.

Understand Read-only access

Read-only tells the agent not to make changes. It does not block changes at the connected service.

To restrict what the service itself allows, use the service’s own account permissions where available.

Administrator details

• Type uses manually entered client credentials first. Otherwise, it tries a reusable saved registration, client metadata, then dynamic client registration (DCR).
• Automatic DCR supports public clients with PKCE and no client secret. It does not support registration that requires existing credentials or creates a confidential client.
• A public client does not mean public account data. Users must still sign in and approve account access.
• Type reuses automatic registrations only when the authorization server, callback URL, and requested permissions match.
• If the service deletes a saved registration, use a manually registered client or create a new connection.
• Type uses the first authorization server advertised by the MCP server. There is no server-selection control.
• Sign-in runs in the web app. Use a browser to set up OAuth connections.
• Sign-in results and connection reviews expire after ten minutes. Start the affected step again if it expires.
• Type does not automatically request additional OAuth permissions after a permission error.
• Type rejects redirects and private network addresses. Use the direct public HTTPS endpoint. Legacy SSE discovery is not supported.
• Type supports tools, but not MCP background tasks, prompts, resources, or server requests for sampling or elicitation.
• Current limits include 100 tools, 100 discovery pages, and 2 MiB of incoming data for each operation. The data limit includes initialization, tool discovery, and results.
• Each tool description can contain up to 4,000 characters. Each schema can contain up to 64 KiB, 24 levels, and 5,000 nodes. Tool inputs can contain up to 64 KiB.
• Initialization and each discovery request have a ten-second timeout. The complete operation has a 30-second deadline.
• A workspace can send a burst of ten operations. Its allowance recovers by one operation each second.
• Type verifies that tool definitions match before a call. This check cannot prove that the service’s behavior is safe or unchanged.

Global does not mean universal

A configured connection can be available globally for assignment without being usable in every Space.

Add it only where the work requires it. An Engineering Space might need GitHub and Linear. A Sales Space might need HubSpot or Salesforce. Sidekick might use its owner’s Gmail, calendar, and documents.

Practical rule

First choose the account with the right source permissions. Then assign the connection to the smallest set of Spaces that need it.

Review Permissions and access before adding a sensitive system.