Agents that call third-party APIs on behalf of users normally hold the OAuth access token. Here is where that token leaks, and how to get delegated access without it.
How to let AI agents act on behalf of users without handing them access tokens
calendar_today
August 10, 2026
domain
workos