> ## Documentation Index
> Fetch the complete documentation index at: https://docs.useagentflow.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations

> Configure native AgentFlow integrations and their tenant credentials

Native integrations bundle system-provided capabilities—such as tools, agents, or provider adapters—with tenant-scoped credential requirements. The integration catalog tells clients what is available, which credential fields are required, whether the tenant is configured, and whether the last connection test succeeded.

```python theme={null}
integrations = await client.integrations.list()
weather = next(item for item in integrations if item.id == "openweather")

configured = await client.integrations.configure(
    weather.id,
    credentials={"api_key": api_key},
)
probe = await client.integrations.test(configured.id)
if not probe.ok:
    raise RuntimeError(probe.message)
```

`configure(...)` replaces the full required credential set for that integration. Credentials are write-only: list and retrieve responses expose status and field metadata, never plaintext secret values. `test(...)` performs the provider's cheapest authenticated probe. Its result is persisted when the tenant has a stored integration record.

The catalog exposes three `credential_mode` values:

| Mode                         | Lifecycle                                                                                                                                     |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| `external_api_key`           | Configure tenant credentials, test them, and remove the tenant override. `install(...)` is rejected.                                          |
| `managed_key_pair`           | Call `install(...)` to converge built-in tools and agent bindings. Snowflake uses this mode and does not accept a generic credential payload. |
| `managed_oauth_installation` | Use the provider-specific admin and OAuth APIs. Slack uses this mode; generic configure, install, and remove operations are rejected.         |

The generic remove operation is only for `external_api_key` integrations. It soft-deletes the tenant credential override; it is not a generic uninstall for native tools or agents. A platform fallback credential may therefore remain active after removal.

MCP servers and toolkits are different extension paths: use [MCP servers](/concepts/mcp-servers) for remote protocol tools and [Tools](/concepts/tools) for persisted custom tools or toolkit imports.

See [SDK: Integrations](/sdk/integrations) and the [Integrations API reference](/api-reference/integrations/list-integrations).