Product Apps

Use this path when you are building a customer-facing product on Runtools, not just an internal agent for your own workspace. Product apps keep your own app auth. Your end users do not create Runtools accounts. Your backend passes a stable appId and externalUserId, and Runtools scopes tool credentials, usage, audit, and channel identities to that product user.

builder org + appId + externalUserId + tool

What You Build

Hosted Connect

Let end users connect Gmail, Stripe, Slack, HubSpot, API-key tools, and other integrations to your product.

Run agents for a product user

Start agent runs with endUser so tools resolve only that user’s app-scoped credentials.

Execute tools directly

Call Tool Hub actions with Hosted Connect scope from your backend.

Product channels

Let users chat over Telegram, WhatsApp, Slack, Discord, iMessage, or SMS while tools still use their Hosted Connect credentials.

Product Identity

Your product owns login, billing, permissions, and user records. Runtools only needs stable identifiers:

const endUser = {
  appId: 'atlas',
  externalUserId: currentUser.id,
};

Use the same pair everywhere:

Hosted Connect sessions
Agent runs
Direct tool execution
Product channel identity links
Usage and audit exports

Connect User-Owned Tools

Create a Hosted Connect session from your server:

const session = await rt.connect.createSession({
  appId: 'atlas',
  externalUserId: currentUser.id,
  email: currentUser.email,
  name: currentUser.name,
  integrations: ['gmail', 'stripe', 'slack'],
  returnUrl: 'https://atlas.example.com/settings/integrations',
});

return Response.json({ connectUrl: session.connectUrl });

Open connectUrl in the browser. Runtools handles OAuth, API-key collection, refresh, encrypted storage, and reconnect states.

Run With That User’s Credentials

Agents:

await rt.agent.run('atlas-agent', 'Summarize my revenue and open finance risks.', {
  endUser: {
    appId: 'atlas',
    externalUserId: currentUser.id,
  },
});

Tools:

await rt.tools.execute('gmail', {
  action: 'list_emails',
  params: { max_results: 10 },
  credentialScope: 'end_user',
  endUser: {
    appId: 'atlas',
    externalUserId: currentUser.id,
  },
});

If the user has not connected the required integration, the tool returns connect_required. It does not fall back to builder Connected Apps, org defaults, or another product user’s credentials.

Product Channels

For chat products, the developer connects the channel once. End users simply message the bot or number. Runtools links the provider sender identity to your product user:

appId + externalUserId + channel + provider sender id

When that sender messages the product channel, the agent run receives the same Hosted Connect end-user scope as your web app.

Where To Go Next

Hosted Connect guide

Full setup, OAuth policy, direct tool execution, API-key tools, usage, and audit.

Tools API

Direct Tool Hub execution, including end-user scope.

Channels SDK

Bind product channels and link provider senders to product users.

OAuth & Connected Apps

Internal Runtools-user credentials, and how they differ from Hosted Connect.

Getting Started

Platform

Core Features

Advanced

What You Build

Hosted Connect

Run agents for a product user

Execute tools directly

Product channels

Product Identity

Connect User-Owned Tools

Run With That User’s Credentials

Product Channels

Where To Go Next

Hosted Connect guide

Tools API

Channels SDK

OAuth & Connected Apps

​What You Build

Hosted Connect

Run agents for a product user

Execute tools directly

Product channels

​Product Identity

​Connect User-Owned Tools

​Run With That User’s Credentials

​Product Channels

​Where To Go Next

Hosted Connect guide

Tools API

Channels SDK

OAuth & Connected Apps

What You Build

Product Identity

Connect User-Owned Tools

Run With That User’s Credentials

Product Channels

Where To Go Next