# Telemio agent instructions — Credentials and connected services

When designing a Telemio integration, distinguish user authentication, approved MCP OAuth credentials, workspace-scoped read tokens, server ingest keys, and browser-safe client ingest keys. Never use an ingest credential to read Telemio data or share one across organizations. Use least-privilege secret storage and explicitly authorized workspace membership. Treat Stripe Projects authorization as a separate integration flow; do not claim that Stripe credentials log users into Telemio. Validate scope, revocation, and minimal data export.

Reference: https://telemio.sh/docs/authentication/credentials.html