When a service offers a first-party connector, use it before teaching the Bot to click through a login page with a password. The official Approvals, security, and privacy page is direct about it: do not send a password or one-time code in ordinary chat.
How it works
1. Your Bot needs access to a service. 2. There's a connector: add it in Connect Apps and sign in with the provider. The plugin acts with only that account's access. 3. No connector, and the page needs a login or form: a secure form in the chat fills the page. 4. No connector, and the page needs a password, passkey, 2FA code, CAPTCHA or payment: you take control of the computer and do that step. 5. Either way, the Bot then continues.
Pick the right path
| Situation | Use | Steps |
|---|---|---|
| The service has a plugin (Gmail, Slack, Notion, Shopify and more) | A connector | Open Connect Apps (or Plugins on the phone), add it, finish Authorize in your browser, confirm it shows under Installed |
| A site needs a login and there's no plugin | A secure form | The Bot shows a form in the chat and fills the page for you (changelog, Sep 6). Since Sep 30 it opens a Secure Form window with the site's name and icon. |
| A password, passkey, two-factor code, CAPTCHA or payment confirmation | Take over | Open Agent Computer, take control, finish the step, return control, tell the Bot to continue |
| A supported connection asks for a secret | The secure secret request | Enter the value there. It's masked, kept out of the transcript and not shown to the model. |
Browser sessions are shared on your computer
If you do sign in to a site in the Bot's browser, remember that every Bot on your account shares that computer. Other Bots can reach that session. Sign out when the job is done.
Common questions
What can a connected plugin do? The Connect plugins help page says a plugin uses the account you authorize and can do only what that account can already do. It can't raise your access or change sharing.
Does connecting a plugin give it to every Bot? Yes. An installed plugin is available to every Bot on that Grok Bot account. Disconnect it if a Bot shouldn't use it. A teammate's Team Bot asks before it uses your accounts.
The plugin says Added, but the Bot says it's missing. Added means installed, not signed in. Open it and choose Authorize if it shows Needs auth or Disconnected.
My work Google account says an admin needs to review Grok. Grok Bot signs in to Google as Grok. Your IT admin has to trust Grok in the Google Admin console. Changing browsers or reconnecting won't clear that block.
Can a Bot use my password manager? The September 28 changelog says that when 1Password isn't connected, Bots ask for site logins with a form in the chat, and offer Connect 1Password only if you have the app.