# Connection Checklist — the order to plug things in Connections are the part that used to eat half a day with other agent tools. Here it happens inside the conversation: you start talking about what you want done, the bot says *"great, I'll check your email, please authorize Gmail"*, and you click through a normal sign-in. **The rule that saves you time:** because every bot runs on the same shared cloud computer, **you authorize once and every bot you ever make has that connection.** Connect Gmail through your inbox bot today, and the content bot you build next month already has it. So do them in this order — each one unlocks more of the course than the last. --- ## The order of operations ### 1 · Gmail *(or your mail provider)* Unlocks: morning brief, inbox-to-board, the billing flow. Do it first — more builds depend on mail than anything else. ### 2 · Calendar Unlocks: the "what to protect today" half of the morning brief. Low drama, high payoff. Your chief of staff is half-blind without it. ### 3 · Your project board ClickUp, Notion, Linear, Asana — whichever you already live in. Unlocks: every build that ends with *"…and put it on my board."* Don't introduce a new board for this; connect the one your team already opens. ### 4 · Slack *(only if you want triggers)* Unlocks: routines that fire when something happens instead of when a clock says so. ⚠️ **The bot only hears channels its app has been invited to.** It gives you the exact invite command — run it once in the channel, and that channel is live. Skip this and your trigger sits there silently. ### 5 · Zapier MCP *(when an app isn't in the marketplace)* Unlocks: 9,000+ more apps — community platforms, newsletter tools, niche CRMs. There's a built-in **Zapier setup** skill: type `/`, pick it, hit send, and the bot installs and configures the connection itself. After that you just name the app you want. ### 6 · Firecrawl *(when you need the open web)* Unlocks: clean scraping. AI agents are surprisingly bad at reading the open web — sites block them and pages come back as mess. Firecrawl fixes that: competitor pricing pages daily, public info on leads before outreach, documentation sites read properly. --- ## When there's no connector at all The bot uses its own browser and logs in like a person would. 1. It pulls up the login screen on its cloud computer. 2. It hands you the controls with a **take-over button**. 3. **You** type your password, directly into the site. 4. The bot never sees your password in plain text. 5. The session stays logged in on its computer, and from then on it can work inside that site whenever you ask. You can do this from your phone too — you're driving a cloud computer with your thumb. --- ## What to hand over, and what not to | Hand over | Why it's fine | |---|---| | Email, calendar | Low drama, and the biggest unlock in the whole system | | Your project board | It's collaborative by design already | | Docs / notes tools | Read-heavy, low blast radius | | Analytics dashboards | Read-only in practice | | Think twice | Why | |---|---| | **Platforms with strict automation terms** (LinkedIn is the usual example) | Their terms aren't friendly to automated access. If the platform decides it doesn't like a robot in your account, **the account at risk is yours** | | **Anything holding money movement** | Never let an agent hold the send button on payments | | **Shared team accounts you don't personally own** | You'd be handing over access that isn't yours to give | | **Your password manager itself** | One account should never open all the others | --- ## Two things that will surprise you **1. Sites see a new device.** When the bot logs in as you, the site sees a Linux machine in a data centre signing in. Some services will email you a verification alert. That's expected — but don't train yourself to click through those without reading them. **2. Every login lives in the same basket.** All your bots share one computer, so it's one security perimeter. The upside: adding your tenth bot adds no new risk. The downside: it's still one basket. See `security-settings-guide.md`. --- ## Quick audit — run this monthly - [ ] List every connection currently authorized - [ ] Remove any you connected "to try" and never used - [ ] Check no bot has access it doesn't need for its one job - [ ] Confirm nothing that sends money or posts publicly can act without your click --- *Part of the Grok Bot AI Full Course — *