Most connectors in Tines 3B authenticate with a single account that everyone shares. Sometimes that isn't what you want.
If a workflow or chat should act as whoever is using it, so that each user's actions run under their own identity and permissions, you can switch a connector to per-user authorization. Each user then connects their own account, and Tines 3B uses the right one automatically.
This article explains how per-user authorization works, when you can use it, and how to turn it on and manage it.
What per-user authorization is
Every connector runs in one of two authorization modes:
Owner mode. The default. You authorize one account on the connector, and every workflow and chat that uses it acts as that single account.
Per-user mode. Each user who uses the connector connects their own account, and Tines 3B uses the user's account for their requests. This includes users who aren't members of your Tines 3B workspace, such as visitors who reach a published workflow.
Per-user mode is useful when a connector's actions should reflect who's actually using it. For example, a request-management workflow can create tickets as the requester rather than as a generic service account, so permissions, ownership, and audit trails stay accurate.
When you can use it
Per-user authorization isn't available for every connector. It works only for connectors that sign each user in individually, which means two things have to be true:
It's an HTTP connector. The connector calls a web API, not a database, email server, or similar service.
It authenticates with the OAuth authorization flow. This is the "sign in with..." flow, where each user is redirected to the provider, signs in as themselves, and grants access. Because every user completes their own sign-in, each one ends up with their own account connected.
Other authentication methods, including API keys, connection strings, and other OAuth grant types such as client credentials and password, all rely on a single fixed credential with no individual sign-in, so there's no way to vary the account per user. For those connectors, the setting won't appear, and the connector keeps using one shared account. If you turn it on for a connector that doesn't qualify, Tines 3B blocks it with the message "Visitor authorization needs an HTTP OAuth connector."
Turn on per-user authorization
First, you need the permission to edit the connector to change this setting.
To turn it on, open the connector you want to change. Find the 'Require each person to connect their own account' setting and click the toggle.
Note: Turning it on disconnects the single shared account that was authorized for everyone, because per-user mode never keeps an owner account.
From that point on, each person connects their own account the first time they use the connector.
How users connect their account
Once per-user mode is on, users connect on demand rather than ahead of time:
In a workflow or chat you build. When you run something that uses the connector and you haven't connected your own account yet, Tines 3B prompts you to connect. After you sign in to the provider, your account is linked and the request proceeds.
For visitors to a published workflow. When a workflow serves users in a browser, the pages it shows can include a Connect link for each per-user connector the visitor needs. The visitor connects their own account, then continues.
When a request runs without a connected account. If code calls the connector and the caller has no account connected, Tines 3B doesn't silently fail. It returns a clear "not connected" response that carries a connect link, so the workflow can show that link instead of erroring out.
A user only ever connects the connectors they actually need, so different users using the same workflow can each connect the accounts relevant to them.
See and manage connected accounts
When per-user mode is on, the connector shows a connected accounts list. If you can edit the connector, you see every account that users have connected, who each one belongs to, and which spaces it covers. If you can only use the connector, you see just your own connected account.
From this list you can disconnect an account.
Note: Disconnecting removes that account from the connector across every space that uses it, so the person will need to reconnect the next time they use it.
Members can also manage their own connections without editing the connector. You can always view and remove the accounts you've connected yourself, even on connectors you don't own.
Turn per-user authorization off
If you turn the setting back off, the connector returns to a single shared account. Before switching, note two things:
All connected accounts are removed. Turning the setting off removes every account users have connected. Tines 3B asks you to confirm first, and users will need to reconnect if you turn the setting on again later.
You'll authorize one account again. Once the setting is off, authorize a single account on the connector for everyone to use, the same way you would for any owner-mode connector.
What happens when you change connector settings
Per-user connections are tied to the exact connector configuration they were created under. If you change something that affects where or how requests are authenticated, such as the connector's URL pattern, its OAuth client, its CA certificate, or its authorization and token endpoints, the existing connected accounts are removed and users will reconnect under the new configuration.
Rotating a client secret alone doesn't remove connections, because the endpoints and client stay the same.
A note on testing
With per-user mode on, a connection test runs as the person requesting it, not as a shared account. To test a per-user connector, you need your own account connected first. That's why Tines 3B doesn't automatically run a connection test for per-user connectors the way it does for owner-mode ones.