> ## Documentation Index > Fetch the complete documentation index at: https://docs.sixtyfour.ai/llms.txt > Use this file to discover all available pages before exploring further. # Connections > Let your research agents use your team's own APIs. Your keys are encrypted and never shown to agents. A connection is one of your team's own HTTPS APIs, such as your CRM, that research agents can call during a run. Sixtyfour keeps the key encrypted and adds it to each call, so agents never see it. A finding read from the API cites the connection by name. > [!NOTE] > > Connections are enabled per organization. Contact [support](mailto:support@sixtyfour.ai) to turn them on. ## Set it up In the app, open **Settings → Agents → Connections** and choose **Connect an API**. Only the base URL and the key are required. Every member can see the team's connections. Team owners add, change and delete them, and on the default team, organization admins and owners do. Through the API, use an API key for the team: | Request | What it does | | - | - | | `GET /connections` | List the team's connections, and whether you can change them. | | `GET /connections/{name}` | Read one connection. | | `PUT /connections/{name}` | Create a connection, or replace its settings. The name can't change later. Leave out `secret` to keep the saved one. | | `DELETE /connections/{name}` | Delete a connection. | Each request may name its team with `team_id`, in a `PUT` body or as a query parameter otherwise. A request for a team other than the key's is refused. ```bash theme={null} curl -X PUT "https://api.sixtyfour.ai/connections/crm" \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"base_url": "https://api.crm.example.com/v2", "secret": "YOUR_READ_ONLY_KEY"}' ``` The response is the saved connection. The secret never comes back, only its last four characters. ```json theme={null} { "id": "6f1d3c2a-8b4e-4f7a-9c1d-2e3f4a5b6c7d", "name": "crm", "description": "", "base_url": "https://api.crm.example.com/v2", "sign_in": { "type": "bearer", "name": null }, "allowed_requests": null, "secret_last4": "_KEY", "created_at": "2026-11-03T18:04:11.512304Z", "updated_at": "2026-11-03T18:04:11.512304Z", "created": true } ``` | Field | Description | | - | - | | `base_url` | Required. An `https://` URL on a public host, optionally with a path. Calls go only under it. | | `secret` | Required to create. The key, token or password. Reads show only its last four characters. | | `description` | Optional. One line on what the API is for, which agents read to decide when to call it. | | `sign_in` | Optional. How the key is sent, below. A Bearer token by default. | | `username` | For `basic` sign-in only. | | `allowed_requests` | Optional. The requests agents may make, such as `"POST /search"`. Left out, the connection is read-only: `GET` and `HEAD` anywhere under the base URL. An empty list is refused. | | `create_only` | Optional. `true` refuses the request if the team already has a connection with this name. | | `sign_in` | Each call sends | | - | - | | `{"type": "bearer"}` | `Authorization: Bearer ` | | `{"type": "header", "name": "X-Api-Key"}` | `X-Api-Key: ` | | `{"type": "query", "name": "api_key"}` | `?api_key=` on each call's URL | | `{"type": "basic"}` | HTTP Basic, with `username` and the secret as the password | ## Use it in a run Runs on `xhigh`, on `scout` with `graph: true`, and on `high` when enabled for your organization can call every connection the team has. To choose which, send `connections` on [`POST /people-intelligence-async`](https://docs.sixtyfour.ai/atlas/integrations#request-parameters). Leave it out for all of them, or send `[]` for none. ```bash theme={null} curl -X POST "https://api.sixtyfour.ai/people-intelligence-async" \ -H "x-api-key: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"lead_info": {"name": "Jane Doe", "company": "Acme"}, "tier": "xhigh", "connections": ["crm"]}' ``` A finding read from a connection cites it by name, and the result lists the cited connections in `connected_sources`, each with its `connection` and `connection_id`. Atlas and the report show the source as "crm, your connection". The [MCP server](https://docs.sixtyfour.ai/developer-tools/mcp-setup.md)'s `sixtyfour_atlas_start` takes the same `connections`. The Atlas API's start and continue endpoints don't. ## Security * The key never reaches agents. Sixtyfour adds it to each call and removes it from each answer before agents read it. * Calls go only under the base URL and make only the requests you allow. They follow no redirects, and agents can't override the connection's credential. * Use a read-only key if your API offers one. A path that both reads and writes, such as `POST /graphql`, needs one. Never allow a login, token or key-management path. * Sixtyfour removes the key wherever it recognizes it, but anything else your API returns, such as a new token made from the key, reaches agents as sent. ## Limits | | Limit | | - | - | | Connections per team | 10 | | Name | Lowercase letters, digits and hyphens, up to 63 characters, starting and ending with a letter or digit | | Description | 200 characters | | Secret | 8 to 4,096 printable ASCII characters; a Basic password may be any one line | | Allowed requests | 5, each `GET`, `HEAD` or `POST` and a path of up to 100 characters | Requests to `/connections` share one [rate limit](https://docs.sixtyfour.ai/api-reference/rate-limits.md#connections). ## Good to know * Changing the host, the sign-in type, or the header or parameter name needs the secret again, so a saved key never goes somewhere it wasn't given for. A Basic username changes only together with the password. If someone replaces the secret during an edit that keeps it, retry the edit or enter the secret again. * A path matches whole segments: `/people` allows `/people/7`, not `/peoples`. * For a scheme like `Authorization: Token abc`, use a `header` sign-in named `Authorization` and paste `Token abc` as the secret. * Runs already going use a connection's saved settings from their next call, including a new key, host or requests. A deleted connection is refused there. * A run that names an unknown connection is refused before it starts or is charged, with the team's connections listed. * An API key acts with its creator's current role in the team. See [Roles and permissions](https://docs.sixtyfour.ai/guides/roles-and-permissions.md). ## Errors For error responses (400, 403, etc.), see [Handling Errors](https://docs.sixtyfour.ai/api-reference/errors.md#connections). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.