Security and disconnecting
How the connection is protected, what gets recorded, and how to take access away from a chatbot.
How the connection is protected#
- OAuth 2.1 with PKCE. You never copy or paste a token. Approval happens in the Agentes console, with your session.
- Short-lived tokens. The chatbot gets access that expires in an hour and renews itself. If it goes unused for 30 days, it has to reconnect.
- Rotation. Each renewal invalidates the previous token. If someone tries to use an old one, the whole connection is revoked.
- Nothing in plain text. Productos AI stores only a fingerprint of each token, never the token.
- Role check. Each renewal confirms you're still an admin or owner.
What gets recorded#
Every change the chatbot makes appears under Activity → Audit in the console, under your name, just as if you had made it.
Disconnect a chatbot#
- 1
Open the connected chatbots
In the Agentes console, go to Settings → Chatbots.
- 2
Disconnect
Find the chatbot in the list, which shows who connected it and when it was last used, and click Disconnect.
The chatbot loses access right away. To use it again, connect and approve it again.
Tip
Disconnect chatbots you no longer use and those of people who leave the team. When you remove someone's admin role, their chatbots disconnect by themselves.
Good practices#
- Before approving, check which address you'll return to. If you don't recognize it, cancel.
- Ask the chatbot to confirm before publishing or archiving. It's already instructed to, but say it in your messages too.
- Use the quality gate on agents that serve customers, so no untested version reaches production.