centerleap
Get started

Agents & Mail Access

An agent acts for your organization with its own scoped identity — not your login. This page covers connecting one, what that connection grants, and the one case where you still need a mailbox API key. To connect a Grok Bot (hosted worker, no centerleap memory), see Connect a Grok Bot.

On This Page

Connecting an agent

Agents attach to one organization at a time using a one-time connect code. Sign in as an owner or admin, open Organization → Agents, and generate a code. Paste it into the agent runtime within 15 minutes.

The code mints an organization agent principal with a limited set of scopes. Your personal login never leaves app.centerleap.com, and you can disconnect at any time.

What the org principal grants

Scopes come from the apps your organization has enabled — mail, CRM, phone, SMS, chat, memory, and tasks. You can narrow them per agent afterwards. The principal is org-scoped: an agent connected to one organization can never act in another.

Tools an agent can use

Tools are granted per agent in its Integrations tab — nothing is on by default, so an agent starts with no tools and you check exactly the ones it should have. Native apps are built into centerleap; Integrations are third-party services you connect per org. Tools marked † are external communication and are approval-gated: the agent prepares the action but a human approves before anything leaves the organization.

Mail

  • ·List emails
  • ·Read email
  • ·Mark spam
  • ·Create draft
  • ·Send draft †
  • ·List / create / apply labels
  • ·Send †
  • ·Reply / reply-all †
  • ·Forward †

Text (SMS)

  • ·Send SMS †
  • ·Read SMS thread

Phone

  • ·Place outbound call †
  • ·AI (Bland) call †
  • ·Hold
  • ·Unhold
  • ·Transfer

Team chat

  • ·Search messages
  • ·Read conversation
  • ·Post message

Tasks

  • ·List tasks
  • ·Create task
  • ·Update task

CRM

  • ·Look up contact (phone / email)
  • ·List contacts

HR

  • ·Search employees
  • ·Upcoming birthdays
  • ·Read time-off

Mail tools use a per-mailbox API key (below); the rest run over the org connection. Endpoint-level detail for the mail tools is in the API Keys reference.

Sending vs. reading mail

An agent acts on a mailbox with a per-mailbox API key. You generate a cl_live_…key for a mailbox (Mail → Settings → Domain → Mailbox → API Keys) and attach it to the agent in its Access tab, along with the mailbox address. The agent uses the key server-side — it is never exposed to the model. One key covers the whole mail surface for that mailbox; the key's scope decides how much:

Send / drafts / labels / spam

A full_access key lets the agent send, reply-all, forward (with attachments), save and send drafts, create and apply labels, and mark spam. Sending is approval-gated — it waits for a human before anything leaves the mailbox.

Reading

A read_only (or full_access) key lets the agent list and read messages — but only on open-tier mailboxes (see below).

Full endpoint reference: API Keys.

The open-tier restriction

API keys only work on open-tier mailboxes.

If you try to create a key on an end-to-end encrypted mailbox, you will see:

{ "error": "api_keys_open_tier_only" }

This is not a policy we can relax. On an end-to-end encrypted mailbox the server stores ciphertext only — it has no key and cannot read the contents. There is nothing for an API key to unlock, so an agent can never read that mailbox no matter how it is configured.

Open tier

Server-readable. Supports API keys, agent reads, fast header lists, and search. Treat contents as org-confidential.

E2EE tiers

Zero-access. No API keys, no agent reads. Choose this when a mailbox must never be machine-readable — and note that agents cannot triage it.

Full detail in the encryption tiers guide. Choose the tier when you create a mailbox — changing it later means re-creating the mailbox.

Adding a read key

  1. In the mail app, open Settings → API keys for the mailbox you want the agent to read.
  2. Create a key with read_only scope unless the agent also needs to manage the mailbox.
  3. Copy the cl_live_… value — it is shown once.
  4. In the agent's Access → Mailboxes section, choose the mailbox and paste the key.

The agent stores the key server-side and never returns it to a browser afterwards — only the last four characters, so you can tell which key is in place. Full API reference in the API keys guide.

Who did what

Every action an agent takes is recorded with the person who asked for it and how it was triggered — a live request from a human, or a schedule running unattended. Scheduled work is attributed to whoever created the schedule, so an overnight job still traces back to a person.