How Cotlet will connect to your apps without your password

The first question everyone asks about an unofficial integration is the right one: what do you do with my login?

Our answer is short. We never store your password. You sign in yourself, and we keep only the session, which you can revoke at any time.

Two ways to connect an account

1. You sign in, we keep the session

This is the default for personal and single-user accounts.

1. You open the connect page for the app. It shows a browser running on our side.
2. You type your login and password, enter your 2FA code, and solve a CAPTCHA if the app shows one. You do all of it yourself.
3. Once you are in, we save only the session (cookies and tokens), encrypted, for you and that one app.

Your password goes straight to the app. It never lands in our database.

2. A service account your admin adds (on the roadmap)

Planned for tools where your company has an admin panel and can invite users (ERP, CRM, HR or accounting systems with roles). It is not available yet:

1. We generate an email address for the integration.
2. Your admin adds it in the app as a new user, with only the permissions the integration needs.
3. Your admin removes that user to end access. The app’s own audit log shows a separate integration account, not a person.

This is the cleanest proof that the company agreed, and it lets the integration sign in again on its own.

When a session expires

Apps log people out. When that happens, the tool call returns AUTH_EXPIRED with a link to the connect page. Your agent asks you to sign in again, and you get an email too.

We do not sign in for you. We cannot: we do not have your password.

You choose what the agent may do

When you connect an app you pick a permission level:

• Read only. The agent can look things up.
• Read and edit. Changes stay with you, for example drafts.
• Full, with confirmation. Anything that reaches other people (sending, publishing, messaging) needs your yes on every call.

What we never do

• Solve CAPTCHAs automatically. A person passes every login challenge.
• Bypass MFA. You enter your own codes.
• Store your password. Only the session, which you can revoke.
• Keep what passes through. Data flows from the app to your agent; we do not store payloads.

Some apps we will not automate at all, such as banks and platforms that ban automation outright. The full list is in our acceptable-use policy, and the vault is described on the security page.