Authentication
Sign in with Shadow, pick a workspace; your client stores a scoped token.
Shadow uses OAuth 2.1 with PKCE — the same standard behind the Stripe, Linear and GitHub MCP servers. You never paste API keys or tokens into your AI client.
How it works
Your AI client redirects you to Shadow's login page.
You sign in with your Shadow credentials.
You select which workspace to grant access to.
Shadow issues a scoped access token — your client stores it automatically.
Every tool call after that is authenticated transparently.
What the token can access
Connected platforms — every integration linked to the workspace you chose.
Workspace content — files, knowledge base and memory.
Slack & meetings — only if connected in Shadow.
What it can never do
Other workspaces — tokens are scoped to a single workspace.
Account & billing — settings can't be touched by an agent.
Unconnected platforms — nothing you haven't explicitly linked.