Connect apps
Connect Gmail, Notion, Slack, 1Password, and other apps so your Bots can use them in chat.
What are apps?
Apps let your Bots work with external services. App connections belong to the same account you used to sign in to Grok Bot.
The Email app is different: it gives your Bots their own email address instead of connecting an account you already have. See Give your Bot an email address.
How do I add an app?
- In Grok Bot, select Connect apps in the sidebar, or follow an in-chat Connect card. In the Grok Bot mobile app, tap your avatar on the top left and select Connect apps.
- Browse or search for the app, then add it.
- When Grok Bot asks you to Authorize or Authenticate, finish the provider login in your browser.
- If sign-in doesn't finish, choose Reconnect on the app, or Reopen on the in-chat card, to bring the sign-in page back.
- Confirm the app appears under Installed.
Why does an app say "Disabled by team admin"?
If you use Grok Bot through a Cursor team, your Cursor team admin controls which apps are available. If an app is disabled, ask your admin to enable it.
That Cursor control is separate from a company Google admin. A Google block uses the screens in the next section.
What if Google says an admin needs to review Grok?
A company Google account can stop the connection before Gmail, Calendar, Drive, Docs, Sheets, Slides, or BigQuery finishes signing in. Grok Bot signs in to Google as Grok, not Cursor. The Google page decides the next step.
Your admin needs to review Grok
Grok is not approved for that Workspace yet. On the Google page, request access if that button is there. Wait for the admin to approve Grok before you try Authorize again.
An IT admin approves Grok in the Google Admin console:
- Open Security, then Access and data control, then API controls.
- Open App access control, then Manage third-party app access.
- Add the app named Grok. If name search does not find it, use the client ID from the blocked page or the admin review email.
- Set Grok to Trusted for the people who use Grok Bot.
That approval covers the Google apps those people connect. It does not turn an app back on in Cursor. A Cursor team admin does that from the Disabled by team admin control above.
Access blocked
Google refused the sign-in. A personal Gmail account does not need a company admin. A company account often hits this when Grok is not on the allowlist, or when the admin has blocked third-party apps.
Ask the Google admin to trust Grok, using the steps above. If the page still says access is blocked after that, contact support with the Google account email and a screenshot of the blocked page. Changing browsers or connecting the app again does not clear a Google admin block.
What if Microsoft says an admin needs to approve Grok Bot?
A work or school Microsoft 365 account can stop Outlook, Outlook Calendar, OneDrive, or Teams from connecting until the organization's Microsoft 365 admin approves the app. Retrying the sign-in or allowing the permissions again doesn't help.
- On your computer, the sign-in page says Your organization's Microsoft 365 admin needs to approve this app before you can connect and shows an Approval link for your IT admin. Send that link to your IT admin. After they approve it, connect again from Grok Bot.
- On the phone app 1.19.0 or later, the connect card says the same and adds Ask your IT admin to approve Grok Bot, then connect again. The phone doesn't show the approval link, so if your admin needs it, connect once from your computer to get it.
If the page says the app is blocked by your organization instead, the admin has to allow the connection. The page lists the connector, the Microsoft Entra application ID, the error code, and the time to send them.
Why does the phone say to connect an app on my computer?
Some providers don't finish sign-in from a phone browser. On the phone app 1.19.0 or later, Connect for Adapter, Robinhood, and Intercom, and for Postiz on iPhone, shows Connect on your computer instead of opening the sign-in page. Open Grok Bot on your computer and connect the app there. The connection then works on your phone too, because apps belong to your account, not the device.
Slack still signs in on the phone. If you close its sign-in before finishing, the phone reminds you that Slack's phone sign-in needs your workspace password, and that you can connect Slack from your computer instead.
What can a connected app do?
An app uses the account you authorize. It can do only what that account can already do in that service. It cannot raise your access, and it cannot change sharing.
Google Calendar
The bot can read calendars you can see, create and update events, check free time, and respond to invitations on calendars you can edit.
It cannot change Google Meet settings, such as the waiting room or host controls. It also cannot add a Zoom link to an event. A Zoom link added from the Calendar website uses Google's Zoom add-on, and that add-on is not available to the app. Put the Zoom link in the event location or description yourself, or create the event in Calendar and ask the bot to update the other fields.
Google Sheets
Connecting Sheets lets the bot read and edit cells in spreadsheets the connected Google account can edit. A file shared as Viewer stays view-only. The app cannot change who has access.
Finding and opening files uses the Google Drive app. Drive can search and read files that account can open. Editing cell content uses Google Sheets.
Slack
The Slack app posts as the Slack user you connected, not as a separate bot that has to be invited. It can post only in channels that user can post in. It cannot post in a private channel that user is not in, or in a channel where that workspace blocks posting. To use another Slack workspace, connect that workspace. This is separate from a Slack message that starts a routine. See Routines.
Gmail
Gmail can search and read mail, draft and send, and apply labels on the connected mailbox.
X
The X plugin needs X API credits on your X developer account. See What if the X plugin is connected but bookmarks, DMs, or the timeline fail?.
Microsoft Power BI
Power BI connects with a work or school Microsoft account. A personal Microsoft account can't connect it. The bot can list workspaces, reports, and datasets, and render a report or one of its pages as images. Every Power BI tool reads only. Rendering needs the workspace on Premium, Embedded, or Fabric capacity, and the Power BI tenant setting Export reports as image files turned on.
Google BigQuery
BigQuery signs in to Google as Grok, like the other Google apps, so a company Google block uses the screens in What if Google says an admin needs to review Grok?. The bot queries the datasets the connected Google account can read. A Cursor team admin can enter the team's own Google OAuth client ID and secret in the plugin's team setup on the dashboard's Plugins & MCPs page; members then sign in under that client instead.
Databricks Genie
Databricks Genie is set up by a Cursor team admin before members can connect it. The admin registers an OAuth app connection in the Databricks account, then enters the workspace URL, client ID, and client secret (left blank for a public client) in the plugin's team setup on the dashboard's Plugins & MCPs page. Each member then signs in with their own Databricks account, and the bot asks Genie questions in natural language against the data that account can query.
Asana
Asana needs no admin setup. Sign in with your Asana account, and the bot works in the workspaces and projects that account can open.
Vanta
Vanta keeps each account in one region. Connect Vanta from Connect apps the first time, and pick the region of your Vanta account when you sign in: United States, Europe, or Australia. A sign-in on the wrong region doesn't find your account; sign in again and choose the other region.
Shop Pay
Shop Pay is a wallet. Connect it and sign in to Shop, and the bot can check out with Shop Pay on Shopify stores, next to a card saved in Vault, Link, or X Money. See Take over for sensitive steps for how the bot pays at checkout.
Can I connect two Gmail accounts?
No. Gmail connects one mailbox at a time. To use a different Gmail mailbox, disconnect the current one and authorize the other. You cannot keep a personal mailbox and a work mailbox connected to Gmail at the same time.
A connected app is available to every bot on that Grok Bot account. Disconnect Gmail if a bot should not use that mailbox. A teammate's shared Bot asks before it uses your accounts.
Some other apps, like Notion, can connect a second account. See How do I add a second account for the same app?
An app is added, but the Bot says it's missing. What do I do?
Added means the app is installed, not that you are signed in. Open the app and choose Authenticate (Authorize on the phone) if it shows Needs auth or Disconnected. For a connect card that never shows up or does nothing, see How do I reconnect an app?
How do I connect 1Password?
1Password lets your Bots sign in to websites on their computer with logins from your 1Password account. You approve each login in 1Password, and 1Password fills it in. Your Bots never see the values.
The new 1Password integration is rolling out gradually. It works with personal and Family 1Password accounts and needs 1Password 8.12.42 or later.
- Select Connect apps and open 1Password. It's under Password Managers.
- On your computer, choose Connect 1Password.
- Your browser opens. Sign in to 1Password there and approve Grok Bot. Grok Bot updates when you're done.
On the phone, open 1Password from the Password Managers shelf in Connect apps, or search for it, then approve the connection in 1Password.
If your phone says 1Password can only be set up on a Mac, the new integration hasn't reached your account yet. Set up 1Password from Grok Bot on your computer instead.
To stop using 1Password, open it in Connect apps and choose Disconnect. Your Bots stop signing in with your 1Password logins until you connect again.
How do my Bots sign in with 1Password?
Your Bots check Vault first. When a login isn't saved there, the Bot sends a card in the chat that names the website.
- Choose Review in 1Password. The 1Password app opens. If the app isn't installed on that computer, 1Password opens in your browser.
- In 1Password, choose the exact logins to share and approve the request.
- 1Password fills the login in the Bot's browser.
A login you share stays available in later chats. If 1Password stops allowing it, the Bot asks again.
1Password does not fill payment cards. Your Bots still ask you to help with steps 1Password can't fill, such as a passkey, single sign-on, or a captcha they can't get past.
Why doesn't 1Password offer the login I want?
1Password only offers logins from your own Personal vault, called Private on Family accounts. It does not offer logins from shared vaults. In the 1Password app, move or duplicate the login into that vault, then ask the Bot to try again.
If no approval prompt shows up at all, check that your 1Password app is version 8.12.42 or later and update it if not.
I used 1Password with Grok Bot before. Why do I need to connect again?
The new 1Password integration no longer uses a service account. Connect 1Password again with the steps in How do I connect 1Password?.
Logins in the vault you shared with the old integration aren't available to Grok Bot until you move them. The 1Password page in Connect apps tells you how many. In 1Password, select those logins and move them to your Personal or Private vault. On a Mac, you can choose Move to Private instead and approve in 1Password if it asks. The old vault stays in 1Password.
What do 1Password messages in Grok Bot mean?
| Message | What to do |
|---|---|
| 1Password didn't finish connecting | Start connecting again. On the phone, if you already have a 1Password account, choose I already have 1Password and sign in with it. |
| This 1Password account is already connected to another Grok Bot account | Disconnect 1Password from the other Grok Bot account first, or connect a different 1Password account. |
| Reconnect required | 1Password no longer accepts the connection. Choose Reconnect. |
| Sign in to the 1Password account you connected to Grok Bot, then try again | 1Password is signed out, or signed in to a different account. Sign in to the account you connected, then ask the Bot to try again. |
| Access requests aren't turned on for your 1Password account | Ask your 1Password administrator to turn on access requests. |
| This request already ended in 1Password | Ask the Bot to try again. It sends a new request. |
| 1Password could not be opened | Open the 1Password app yourself to review the request. |
| A message that asks you to revoke Grok Bot's access under Integrations in 1Password | In 1Password, revoke Grok Bot's access under Integrations, then connect 1Password again. |
Why does connecting to Zoom fail with error 4700 during authorization?
This is a known issue, and our engineers are working on a fix. Zoom authorization from the Grok Bot desktop app currently fails with error 4700 (Invalid redirect), and no change on your end will resolve it.
There is no workaround for now. We will update this article once Zoom can be connected.
Why does SharePoint admin consent fail with a redirect URI error (AADSTS50011)?
This is a known issue, and our engineers are working on a fix. When a Cursor team admin connects SharePoint from the dashboard Integrations page and chooses Application-level permissions, Microsoft shows AADSTS50011 (redirect URI mismatch) before the consent prompt. The Microsoft app named in the error belongs to Grok, not your organization, so nothing in your tenant causes this and no change in your Entra admin center will clear it.
Workaround: connect with Delegated permissions instead.
- In the Cursor dashboard, open Integrations and find the SharePoint card.
- Choose Connect team (or Reconnect if you already started setup) and pick Delegated permissions.
- Enter your Microsoft tenant ID (for example contoso.onmicrosoft.com, or the GUID from Microsoft Entra ID > Overview).
- Sign in with Microsoft. Most work or school tenants need a Microsoft admin to consent once to Sites.Read.All.
- Each team member signs in with their own Microsoft account the first time a bot uses SharePoint. They see only the sites their account can already open.
If you started Application-level setup and members now see "This team does not have the SharePoint integration", the admin needs to finish the Delegated sign-in above. The app stays unavailable until that Microsoft step completes.
We will update this article when Application-level permissions can be approved.