I have built an adapter that calls Composio tools, and I wanted to check on a security concern. Since the adapter will interact with an LLM — then GPT calls Composio — I want to confirm whether the Composio access token is handled securely for users. Previously, my own Composio account got blocked, which caused me to receive a lot of spam and fake emails. Could you please clarify how the access tokens are secured and what measures are in place to protect user credentials? Thanks! https://cdn.discordapp.com/attachments/1428682513244753951/1428682513794203729/Screenshot_2025-10-01_at_10.48.35_PM.png?ex=68f363c6&is=68f21246&hm=d5f1c90985e36f0971dac70db6d4090f2f9a422fa18021eb173cfe8cedd99d2c&

Token security: The LLM just generates the request body. We pass the auth securely without the LLM's involvement. Account block and spam emails: The "This app is blocked" happens when you try to request scopes that aren't available in the OAuth app. It's a warning and safety feature from Google, not the cause for spam and fake emails. Learn more about security here: Security at Composio: https://trust.composio.dev/ How data is processed and stored: https://trust.composio.dev/faq?s=u1cihc8gcmln3y1a2fqyi

but in composio dashboard i can see all user auth token

Yes, you can see access tokens — this supports workflows where you need direct token access. We're currently working on RBAC (Role-Based Access Control) to add restrictions and give you better control over token visibility

Just one last question: if any developer builds an AI agent using Composio for a user, will the developer have the user's access token? Will that developer be able to access the user's email? And you mention everything is encrypted, but the developer can still see the user's token. @abhishekpatil4 ^

We recently introduced this feature where you can mask the connected accounts details both from dashboard & API. https://cdn.discordapp.com/attachments/1428682513244753951/1435180904338423808/Screenshot_2025-11-04_at_1.46.01_PM.png?ex=690b07df&is=6909b65f&hm=d0d71c00a9d30c4ca5136ee36e9c51cf6ed5b994939f30e78a216e21c8e17d7f&