It’s not me, it’s you

Until recently, every connector in 3B had one account behind it. Whoever set it up did the OAuth dance, and every run used their OAuth access from then on. That works for a shared bot, but it falls apart when you want a workflow that lets every user file a Linear ticket as themselves (the caller), or reads data that only their account in that external service can see.

Now, any connector that uses OAuth can "Require each person to connect their own account." Each person connects once, and any run they start uses their own access. If someone hasn't connected yet, the workflow can show them a link to connect.

When we first built this, 3B always put its own consent screen in front of the workflow. We soon realized that was too prescriptive. People build very different things on top of these connectors, and one workflow might serve different audiences, like a requester and an approver who each need different connectors. So now workflows serve their own consent screens instead. A web page doesn't need a separate screen at all. It can just show a Connect button wherever it makes sense, like right next to the feature that needs it.

Early customers also told us they didn't want someone with read access to a space to stumble across a run that used another person's account. So output from those runs is hidden by default, and seeing it takes a deliberate "View anyway" click that goes in the audit log.

My favorite use so far is a Slack MCP server we built as a workflow in 3B. Its Slack connector asks each person to connect their own account, so when I ask my agent about a conversation, it reads Slack as me. That means it can pull in my DMs and private channels, but nothing I couldn't open myself. A teammate using the same server only gets what their own Slack account can see.

There's more on setting it up in the 3B docs.