Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use delegated authorization, not password sharing. The account owner signs in on the provider’s own page, approves narrowly defined permissions, and gives the agent an access token or brokered credential. The agent can then perform only the approved actions, while the password, multifactor codes, and recovery details stay private.
For unattended work on company-owned data, use a separate agent or application identity with limited permissions instead of a human administrator’s login. These patterns are safer than putting a password in a prompt, but they are not automatically safe: tokens can remain valid after a password reset, and a malicious or misconfigured agent can misuse every action its grant allows.
Choose the access pattern before connecting anything
Start by deciding whose authority the agent needs and what data it must reach. A personal email task is different from an autonomous process that works on a company’s shared files. The correct authentication pattern depends on data ownership, whether a person is present, the required scope, and how access will be audited and revoked.
| Situation | Recommended pattern | Checks before approval |
|---|---|---|
| The agent reads or changes one person’s email, calendar, or files | User-delegated OAuth authorization-code flow | Confirm the consent screen names the expected application; request only the required read or write scopes; learn how to revoke consent. |
| An unattended agent works on shared company data | Dedicated agent identity with application permissions or machine-to-machine OAuth | Use a separate identity, avoid a shared human password, obtain administrative approval, limit permissions, and enable audit logging. |
| The user has signed in, but a downstream service must enforce that user’s existing rights | On-behalf-of token exchange | Both identity systems must support the exchange; verify that the downstream service receives the user and agent context and performs its own authorization checks. |
| The target accepts only an API key or legacy credential | Credential broker, proxy, or managed secrets service | Ensure the agent cannot read the raw secret, restrict outbound destinations, rotate the credential, and limit the account or key itself. |
Microsoft describes delegated Microsoft Graph access as user-centric and bounded by what that user can access. AWS likewise documents authorization-code OAuth for user-specific data with explicit consent. Google’s agent guidance distinguishes delegated OAuth, machine-to-machine OAuth, API keys, and legacy authentication. Provider support is not universal, so do not promise a password-free connection until the service documents an appropriate flow.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How delegated OAuth works
In the common authorization-code flow, the agent starts a connection and sends you to the account provider’s sign-in and consent page. You authenticate directly with the provider, not inside the agent’s chat box. The provider displays the application name and requested scopes, such as reading mail or editing a particular calendar. After approval, the provider returns a short-lived authorization code to the application, which exchanges it for an access token. A refresh token may be issued for continued access.
The agent uses the access token on API calls. It does not need your password, one-time code, recovery code, or browser session cookie. The token represents the grant you approved, so its permissions are still important: a token with write or administrative scope can authorize consequential actions even though the password was never disclosed.
Delegated access is for a person’s data
Use this model when the task is tied to your mailbox, calendar, cloud files, or another resource you personally control. The provider evaluates what you can access and limits the delegated token accordingly. Ask for a folder, mailbox, calendar, repository, or endpoint when the integration permits resource-level selection; an entire account is rarely necessary.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Application access is for autonomous workloads
When an agent runs in the background over organization-owned data, give it a dedicated workload identity. An administrator can grant narrowly scoped application permissions or configure machine-to-machine OAuth. This separates the agent from employees who may leave, change roles, or hold excessive privileges. Microsoft’s documentation covers resource-level Azure roles, mailbox-level Exchange permissions, per-team Teams permissions, and expiring access-package assignments. Its agent guidance also blocks examples of particularly high-risk tenant-wide permissions.
On-behalf-of exchange preserves both identities
An on-behalf-of flow is useful when a user has already authenticated to the agent and the agent must call another service. The identity provider exchanges the first token for a downstream token that carries user and client context. The downstream service must still enforce its own authorization; merely receiving an exchanged token does not make an unsafe permission design safe.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step-by-step: connect a personal account safely
- Define the task and resource. Write down the exact action: read new messages, create calendar events, summarize one folder, or update a particular file set. Identify whether the data is personal or organization-owned.
- Open the provider’s official integration. Use the service’s built-in “Connect account,” “Sign in,” or administrator-approved integration. The sign-in page should belong to the account provider or its recognized identity platform. Never paste a primary password, multifactor code, recovery code, or session cookie into a prompt or agent configuration.
- Inspect the consent screen. Check the application name, publisher, redirect context, requested scopes, and whether access is read-only or includes writes. Stop if the screen requests administrative, tenant-wide, or unrelated permissions for a narrow task.
- Approve the smallest useful grant. If the provider offers resource selection, choose one mailbox, folder, calendar, drive, repository, or team rather than the whole account. Decline optional scopes that the task does not require.
- Verify the resulting behavior. Have the agent perform a harmless read or other low-risk operation. Confirm that it cannot access an unrelated resource and that any write action requires the intended review or confirmation.
- Record and review the grant. Note the application, scopes, approval date, owner, and intended purpose. Locate the provider’s connected-app or consent-management page before you need it.
- Revoke temporary access. If the task is one-time, revoke the app grant or token immediately afterward. If the provider supports expiration, use it rather than creating a permanent connection.
How to configure an unattended agent
Background work should not depend on an employee’s password. Create a distinct agent or application identity, then grant only the permissions needed for the workload. Keep the identity separate for each materially different job when possible; a document-indexing agent should not automatically inherit permissions intended for payroll or directory administration.
Minimum controls for an agent identity
- Use a dedicated identity owned by the organization, not a personal administrator account.
- Assign the narrowest application permissions and resource roles available.
- Require administrative approval for sensitive scopes.
- Enable provider audit logs for consent, token issuance, API calls, and permission changes.
- Set an expiration or review date for access packages and credentials.
- Store client secrets, private keys, and refresh tokens in managed secure storage, not source control, prompts, tickets, or ordinary logs.
- Rotate and revoke credentials when the workload changes, is retired, or shows suspicious activity.
Microsoft and AWS distinguish this application-identity pattern from delegated per-user access. A machine identity is appropriate for organization-owned resources, but it should not become a shortcut to broad tenant administration.
Recommended Free Tools
Keep tokens and legacy secrets out of the agent’s context
OAuth removes the need to disclose a password, but an access token is still a credential. Do not place access or refresh tokens in the model’s conversation, system prompt, tool output, browser history, source repository, or debug logs. Limit which tools can receive the token and prevent untrusted plugins from reading it.
Use a credential proxy when an API key is unavoidable
If a target system supports only an API key or legacy credential, put the value in a managed secrets service or credential proxy. The proxy injects authentication into an approved outbound request while the agent sees neither the raw secret nor an unrestricted network. Google’s managed-agent guidance describes this design and recommends an outbound destination allowlist.
Configure the proxy to permit only the required hostnames, HTTP methods, paths, and operations. Restrict the API key itself by account, endpoint, IP range, or read/write capability when the provider supports those controls. Rotate it on a schedule and after any suspected exposure.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Avoid Basic Authentication
HTTP Basic Authentication sends a username and password as an encoded header; encoding is not encryption. Google Cloud documentation explicitly says this method is not recommended. If a service offers OAuth, use it. If it does not, prefer a brokered secret with network restrictions and a narrowly limited account, or reconsider whether the integration is appropriate.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Review scopes with least privilege
Translate every requested permission into a concrete task before approving it. “Read messages” and “send messages” are different capabilities. “View files” and “delete files” are different capabilities. Administrative directory access is not justified merely because an agent might eventually need more information.
- Read versus write: begin with read-only access for classification, search, or summarization.
- Resource boundaries: select one folder, mailbox, calendar, repository, team, or API route where possible.
- Administrative scope: reject tenant-wide or directory-wide permissions unless the workload genuinely performs that function and an administrator has approved it.
- Time limits: use an expiring assignment for a temporary project.
- Action controls: add human confirmation or service-side policy checks before sending messages, deleting records, approving payments, or changing access.
Least privilege limits the damage from a compromised or misdirected agent, but it does not make the agent’s permitted actions harmless. A read-and-send mailbox grant can still expose confidential mail or deliver an unsafe message, so consequential operations need additional controls.
Monitor consent, tokens, and agent behavior
Access management is a lifecycle, not a one-time sign-in. Record who approved the connection, which application received it, what scopes were granted, which resources were included, and when it should expire. Review provider logs for unusual consent grants, token issuance, sign-ins, API volume, destinations, and write operations.
The Australian Cyber Security Centre’s September 2026 system-access guidance warns that malicious actors can abuse legitimate OAuth flows to obtain enduring access without stealing credentials. Such access can continue independently of the user’s password and may survive a password reset. Therefore, a password change is not a complete response: explicitly revoke the application grant or tokens through the provider’s access-management controls.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Restrict device-code login where your organization does not need it. Device-code flows can be abused when a user is persuaded to enter a code supplied by an attacker. Centralize consent logging and alert on new applications, unusual scopes, impossible-travel patterns, unexpected token use, or an agent calling resources outside its normal workload.
What to do when a service has no safe delegated flow
Many consumer websites do not offer scoped OAuth, an API, or an integration designed for agents. Do not work around that limitation by sending a password or session cookie to the model. First check whether the provider offers an official integration, an API key with resource restrictions, or an organization-approved connector.
If the service requires a credential, use a broker or managed secrets service that keeps the raw value outside the agent and restricts outbound requests. Treat this as secret brokering, not delegated authorization: the downstream system may still see a fixed account identity, and revocation, rotation, and audit controls may be weaker than with OAuth.
If no provider-supported or brokered method can constrain access, the safe answer may be not to connect the account. A password-free promise is not meaningful when the only available method gives an agent unrestricted control of a human account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common failure modes and recovery
The consent screen asks for far more than the task needs
Cancel the flow. Verify the application publisher and integration source, then look for a narrower permission set or a different official connector. Do not approve broad write or administrative scopes merely to make setup succeed.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The agent can see a token in its output
Stop the workload, revoke the exposed token or app grant, inspect logs and conversation history, and issue a replacement through secure storage. Remove token values from debugging and telemetry systems, then tighten tool and proxy permissions.
Password reset did not stop access
Review connected applications, OAuth grants, refresh tokens, service principals, and API keys. Revoke the specific grant or credential and inspect audit logs for use after the reset. The ACSC specifically cautions that malicious OAuth access can persist beyond a password change.
The provider supports only a shared human login
Ask whether it offers an API, OAuth, service account, delegated integration, or machine identity. If not, isolate the account, reduce its permissions, place the credential behind a proxy, and require human approval for consequential actions. Do not use an administrator’s primary account for routine automation.
The agent needs a permission that the platform blocks
That restriction may be intentional. Microsoft’s agent identity guidance blocks certain high-risk permissions and favors delegated access for user-centric work. Redesign the task around a narrower resource role, a human-approved step, or a separate service that can enforce policy.
A practical approval checklist
- The task, data owner, and exact resources are written down.
- The sign-in occurred on the provider’s official page or approved identity platform.
- The consent screen identified the application and listed understandable scopes.
- Read-only access was used where writes were unnecessary.
- An unattended workload has its own identity rather than a human administrator’s password.
- Tokens and secrets are hidden from the model, logs, source control, and untrusted tools.
- Outbound destinations are allowlisted when a proxy is used.
- Approval, scopes, owner, expiry, and revocation steps are recorded.
- Audit logs cover consent, token issuance, resource access, and write actions.
- A low-risk resource was used for initial verification.
- Temporary access is revoked after the task, and password resets are not treated as token revocation.
Frequently Asked Questions
Can an AI agent access my email without knowing my password?
Yes, when the mail provider supports delegated OAuth or an approved integration. You authenticate with the provider, approve specific scopes, and the agent receives a token limited to those permissions.
Does changing my password revoke an OAuth connection?
Not necessarily. OAuth grants and refresh tokens can remain valid after a password reset. Revoke the connected application or token explicitly and review its audit activity.
What if a website has no OAuth or API?
Do not paste your password or session cookie into the agent. Use an approved credential proxy with a restricted account if available; otherwise, the service may not be suitable for safe agent access.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Should I give an autonomous agent my administrator account?
No. Use a dedicated agent or application identity with narrowly scoped permissions, administrative approval, expiration where possible, and audit logging.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
