OneCLI connects AI agents to Affinity using an API key. Agents can manage relationships, track deals, log interactions, and query your CRM data. The gateway injects the API key into requests to the Affinity API automatically.This is useful for agents that need to look up contacts, update deal pipelines, or log meeting notes without manual CRM data entry.
Access is per agent: grant the connection to each agent that needs it, choosing per tool what runs freely, what needs human approval, and what stays blocked — a read-only agent is a single grant. Organization rules add guardrails on top, like rate limits and blanket blocks. Everything is checked before credential injection, so a blocked request never reaches Affinity.
Create a new key in Affinity under Settings > API, then paste it into Connections > Affinity in OneCLI. Agents pick up the new key automatically. Then delete the old key in Affinity.
How do I keep the Affinity key out of the agent's context?
Store it in OneCLI instead of an environment variable or prompt. The gateway injects it at the proxy, so the agent never holds the key. See How it works.
Can an agent read Affinity without changing records?
Yes. When you grant the connection, allow the read tools and block or require approval for writes. A read-only agent is a single grant.
