connections, proxy, and activity — let agents call your services without ever holding a token.
Bestmate is a credential broker. You connect a service (Gmail, and others as
they land) to Bestmate once. When an agent needs to call that service, it calls
through Bestmate: it authenticates with your sk-kaya-* key, and Bestmate
injects the real credential server-side.
Your agent never sees, stores, or asks you for a raw API token or OAuth key. If
an agent asks you to paste one for a connected service, that’s the wrong path —
point it at bestmate proxy.
# Read your own recent mailbestmate proxy gmail "/gmail/v1/users/me/messages?q=from:amit"bestmate proxy gmail "/gmail/v1/users/me/messages/<id>"# Act as a specific connected accountbestmate proxy gmail "/gmail/v1/users/me/messages" --account kaya@forever22.com# Fan the same read out across every connected inboxbestmate proxy gmail "/gmail/v1/users/me/messages?q=is:unread" --account all# A writebestmate proxy gmail "/gmail/v1/users/me/drafts" --method POST --body '{"message":{...}}'
Flag
Description
--method
HTTP method (default GET)
--body
JSON request body, for POST / PUT / PATCH
--account
Which connected account to act as (an email) — or all to run the read against every connected inbox, with results per account
--account all routes through the cloud broker and is read-only — GET and
HEAD only. A write has to name one account.
The control-plane log: what your agents have actually done through the gateway.
This is the point of brokering rather than handing out tokens — every call is
attributable and revocable.To cut an agent off entirely, revoke its key:
bestmate keys listbestmate keys revoke <id>
If a service shows as not connected
Connect it first — from the macOS app, or by texting the Bestmate number —
then retry. Don’t work around it with raw credentials.