This setup documentation outlines how to securely connect third-party AI assistants to the fraink-platform.

Connection Architecture

There are two distinct entry points, both inheriting the connecting user's exact permission profile:

• OAuth Connectors: For ChatGPT and Claude. Uses standard OAuth with PKCE, dynamic client registration, and refresh tokens. Setup points to the MCP endpoint: https://fraink.com/mcp (see page-3192563).
• Personal Access Tokens: For Grok, Gemini, and custom HTTPS API assistants. Users issue a token via their profile and point the assistant to https://fraink.com/api/v1 with a bearer token.

Security & Audit Realities

• Zero Raw Storage: Fraink never stores raw tokens—only one-way hashes.
• Dynamic Scoping: Permissions are never frozen onto the token. Every single call dynamically checks the connecting user's current active role. If you demote a user, their connected assistant's access is revoked instantly.
• Hard Attribution: All assistant actions are logged under the connecting human's identity. There are no independent agent personas in the audit log (see page-3192561).
• Public Info: Discovery files are at /llms.txt.