OAuth 2.1, not API keys
Every connection between your assistant and a B77 app is authorized with OAuth. The app publishes RFC 9728 protected-resource metadata, the client uses PKCE, and the token it receives is yours alone — scoped to your account, never shared between users.
You never paste a long-lived key into a chat window. Tokens are revocable from your B77 account at any time, and revoking one cuts that assistant off without touching your other connections.
Per-user credential vault
Some apps need a credential of yours to do their job — a Nightscout token, Google Ads access. Those are encrypted per user with a data-encryption key held in the platform’s secret store. Nobody else on B77 can see them, and they are never returned to the assistant.
The app uses your credentials server-side, on your behalf, only for the calls you make. Delete the connection and the stored credential goes with it.
Usage audit
Every authenticated tool call is logged: who made it, when, which tool, and from which client. App owners can read a 30-day usage view for the apps they operate.
When a connection is shared, each call is logged with both identities — the person who made the call and the person whose access it ran under. Nothing runs unattributed.
EU hosting
The platform and the apps it operates run in EU data centres — the Frankfurt and Helsinki regions named on each app page. Data handling is GDPR-aligned, and there is no silent retention: what an app stores, and for how long, is stated on its page.
What an app can see
Each app page carries a "What this app can see" block: what it reads, what it writes, what it never sees, and what it stores. Read it before you install, the way you would read an app’s permissions on a phone. Browse the catalog at /apps.
Browse apps