What is AgentKit

AgentKit lets your AI agent act in third-party apps on behalf of each of your users. A user connects their Gmail, Slack, Salesforce or GitHub account once through an authorization link. Scalekit stores and refreshes their tokens, and your agent calls prebuilt tools such as gmail_send_message with that user’s ID. Your code never handles OAuth tokens.

412 connectors · Python and Node.js SDKs · REST API · Any MCP client

New to AgentKit? Start with the Quickstart. Looking for something specific? See all AgentKit sections.

• An inbox assistant reads, labels and drafts email in each user’s Gmail or Outlook.
• A sales copilot logs calls and updates deals in Salesforce or HubSpot after every meeting.
• An engineering agent files issues and reviews pull requests in GitHub, Linear or Jira.

1. Once per app1 · You set up a connectionin the dashboard
2. Once per user2 · Your user approves accessauthorization link
3. Scalekit3 · Scalekit stores tokensconnected account is ACTIVE once any user verification passes
4. Every tool call4 · Your agent calls a toolidentifier + tool name

Gmail, Slack, GitHub…API call with the user's tokenScalekit adds the token, calls the API and returns JSON to your agent.

How AgentKit works covers the full model, every term and every connected-account status.

	From your code (SDK)	From an MCP client
You get	Tool schemas and execute_tool in Python or Node.js	A Virtual MCP server URL, with a session token for each user
Works with	LangChain, Google ADK, OpenAI, Anthropic, Vercel AI SDK, Mastra, your own loop	Claude Managed Agents, CrewAI, any MCP client
Pick it when	You build and host the agent	The agent already exists and speaks MCP

Scalekit handles	You build
OAuth flows and consent screens for every connector	Pick which apps to connect, once, in the dashboard
Encrypted token storage and refresh	Pass a stable, hard-to-guess ID for each user
Tool schemas, tool execution and the API proxy	Verify users in production
Webhooks when an account’s status changes	Choose which tools each agent gets

• Compliance: SOC 2 Type II and ISO 27001 certified. GDPR and CCPA compliant. HIPAA eligible, with a Business Associate Agreement on Enterprise plans.
• Token vault: every OAuth token and API key is encrypted with a key unique to your environment before it’s stored. That key is wrapped by a master key in Google Cloud KMS, held apart from the database, so a copy of the database alone yields nothing usable.
• Tool call data: responses pass through to your agent and aren’t stored. Tool call logs record the call’s metadata, not its content. See what Scalekit stores.
• Encryption: AES-256 at rest and TLS 1.3 in transit. Bring your own key from your Google Cloud KMS; revoking it makes the stored data unusable to Scalekit.
• Data residency: separate US and EU deployments with no shared state. The EU region runs in Frankfurt.
• Self-hosted: with an enterprise license, run AgentKit in your own infrastructure, on Kubernetes or Docker. Once installed, it has no connection to Scalekit’s infrastructure.

Security and compliance covers how credentials are stored, what Scalekit keeps, and what your app is responsible for. Audit reports and penetration test summaries are available under NDA from the Trust Center. Read the Data Processing Agreement, which lists sub-processors. See pricing for plans.

Every part of the AgentKit docs, in the order you build. Each section matches a group in the sidebar.