# Three ways to let an AI agent call third-party APIs on behalf of a user

DevFeed: [Three ways to let an AI agent call third-party APIs on behalf of a user](<https://devfeed.tech/articles/three-ways-to-let-an-ai-agent-call-third-party-apis-on-behalf-of-a-user-15997.md>)

Original publisher: [Read original article](<https://workos.com/blog/ai-agent-third-party-api-access-patterns>)

Author: WorkOS

Published: 2026-08-27T00:00:00Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [apis](<https://devfeed.tech/tags/apis.md>), [hubspot](<https://devfeed.tech/tags/hubspot.md>), [linear](<https://devfeed.tech/tags/linear.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [patterns](<https://devfeed.tech/tags/patterns.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [security](<https://devfeed.tech/tags/security.md>), [slack](<https://devfeed.tech/tags/slack.md>), [third-party](<https://devfeed.tech/tags/third-party.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

This article explains three patterns for letting an AI agent access third-party APIs on a user's behalf: storing OAuth credentials yourself, fetching tokens at runtime, or using a proxy that keeps tokens out of the agent-controlled runtime. It compares their operational and security implications and recommends choosing based on where the code runs and the system's requirements.

## Source excerpt

Store the token yourself, fetch it at runtime, or never hold it at all. Where the credential ends up in each pattern, what each one costs, and how to pick without guessing.