> ## Documentation Index > Fetch the complete documentation index at: https://auth0.com/llms.txt > Use this file to discover all available pages before exploring further. # Call Third-Party APIs on User's Behalf > Enable your AI agent to call third-party APIs on the user's behalf with Token Vault. A third-party API is owned and operated by an external organization, such as Google, Slack, or GitHub. The user can grant your AI agent permission to access a third-party API on their behalf using [Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault.md). When a user connects with an external provider and authorizes access, Auth0 stores the provider's tokens in Token Vault. The agent then performs a token exchange to retrieve an external access token scoped to the permissions the user has granted. ## How it works Token Vault supports the following token exchange patterns depending on your application type. ### Refresh token exchange Use the refresh token exchange when your application can obtain Auth0 refresh tokens, such as web, mobile, or native applications. This allows the agent to call external APIs even when the user is not actively using the application. ![Token Vault using Refresh Tokens](https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/ai/authentication_for_users_of_ai_applications_diagram_light.png) Token Vault using Refresh Tokens **1. User connects external provider** The user logs in and authorizes access to an external provider (e.g., Google) via the [Connected Accounts flow](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/connected-accounts-for-token-vault.md). Auth0 stores the provider's access and refresh tokens in Token Vault. **2. Agent requests external access token** When the agent needs to call the external API, it performs a refresh token exchange — passing the Auth0 refresh token to the `/oauth/token` endpoint to retrieve the external provider's access token from Token Vault. **3. Token Vault returns external access token** Auth0 validates the refresh token, locates the stored external token, and returns the external provider's access token to the agent. **4. Agent calls the external API** The agent uses the external access token to call the third-party API on the user's behalf and returns the response to the user. If your application uses [Organizations](https://auth0.com/docs/manage-users/organizations.md), authenticate the user with the target organization before authorizing the external provider through Connected Accounts. Organizations determine the session context, but Token Vault still exchanges tokens for the individual signed-in user. ### Access token exchange Use the access token exchange when your application cannot obtain refresh tokens, such as Single-Page Applications (SPAs) or headless agents and CLIs. The backend API performs the token exchange using a Custom API Client linked to itself. ![Token Vault using Access Tokens](https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/ai/web_applications_with_spa_diagram_light.png) Token Vault using Access Tokens **1. User connects external provider** The user logs in and authorizes access to an external provider via the [Connected Accounts flow](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/connected-accounts-for-token-vault.md). Auth0 stores the provider's tokens in Token Vault. **2. SPA calls backend API with Auth0 access token** The SPA passes the Auth0 access token in the `Authorization` header when calling the backend API. The backend validates the token's signature, issuer, audience, expiration, and scopes. **3. Backend performs access token exchange** The backend uses a Custom API Client — configured with the same identifier as the backend API — to exchange the Auth0 access token for the external provider's access token via the `/oauth/token` endpoint. **4. Token Vault returns external access token** Auth0 validates the request, locates the stored external token, and returns the external provider's access token to the backend. **5. Agent calls the external API** The backend uses the external access token to call the third-party API on the user's behalf and returns the response to the user. ## Connections Auth0 supports popular social and enterprise external providers such as Google, GitHub, Slack, and more. Once the user logs in and authorizes access to the external provider, their account is added to Auth0 as a Token Vault connection. With Token Vault, AI agents can securely access external (third-party) APIs through authorized connections to perform tasks on the user's behalf, such as: * Reading a user's Google calendar to schedule a meeting. * Accessing a user's Microsoft documents to summarize them. * Connecting to a CRM like Salesforce to retrieve customer information. > **[View All Connections](https://auth0.com/ai/docs/connections/overview)** ## Get started To begin using Token Vault with your AI agents, refer to the following resources: ### Quickstarts > **[Call Third-Party APIs on User's Behalf](https://auth0.com/ai/docs/get-started/call-third-party-apis-on-users-behalf.md)** ### Guides > **[Check Google Calendar Availability](https://auth0.com/ai/docs/how-tos/check-google-calendar-availability.md)** > **[List GitHub Repositories](https://auth0.com/ai/docs/how-tos/list-github-repositories.md)** > **[List Slack Channels](https://auth0.com/ai/docs/how-tos/list-slack-channels.md)** > **[Get Salesforce Opportunities](https://auth0.com/ai/docs/how-tos/get-salesforce-opportunities.md)** ### Sample Apps > **[Assistant0: Next.js + LangGraph](https://github.com/auth0-samples/auth0-assistant0/tree/main/ts-langchain)** > **[Assistant0: Next.js + Vercel AI SDK](https://github.com/auth0-samples/auth0-assistant0/tree/main/ts-vercel-ai)** > **[Assistant0: FastAPI + LangGraph](https://github.com/auth0-samples/auth0-assistant0/tree/main/py-langchain)** > **[Assistant0: Next.js + LlamaIndex](https://github.com/auth0-samples/auth0-assistant0/tree/main/ts-llamaindex)** > **[Assistant0: FastAPI + LlamaIndex](https://github.com/auth0-samples/auth0-assistant0/tree/main/py-llamaindex)** > **[Auth0 AI SDK TypeScript samples](https://github.com/auth0/auth0-ai-js/tree/main/examples/calling-apis)** > **[Auth0 AI SDK Python samples](https://github.com/auth0/auth0-ai-python/tree/main/examples/calling-apis)** ## Learn more > **[Configure Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/configure-token-vault.md)** > **[Refresh Token Exchange with Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/refresh-token-exchange-with-token-vault.md)** > **[Access Token Exchange with Token Vault](https://auth0.com/docs/secure/call-apis-on-users-behalf/token-vault/access-token-exchange-with-token-vault.md)**