Concepts
Isolation and security
The guarantees WOOL makes about your users' accounts.
These are the guarantees WOOL makes, stated as promises about behavior, so you can pass them on to your users and your security review.
Each run is isolated
Every authorization and every execution runs in its own session, created for that request and discarded after it. A saved sign-in is available only to runs on its connection. A run on another connection, or an application or developer that doesn't own the connection, cannot use it.
WOOL shares sign-in discovery routes across the service to reduce repeated navigation work. That cache contains no passwords, one-time codes, saved sign-ins, execution prompts, or task results. Every user still authorizes your application and completes their own sign-in.
Credentials never leave the connect page
The user types their password, and any one-time code, on connect.trywool.com. Those values go into the
isolated sign-in and nowhere else. Your product never receives them, no result contains them, and WOOL doesn't
return, log, or store them.
The saved sign-in is encrypted and yours to delete
Between runs WOOL keeps the signed-in session for the connected website, encrypted at rest and bound to the connection, so a run can start already signed in. Revoking the connection deletes it, and the API never returns it.
What a run will not do
A run acts only as the connected account, on the connected website. It won't sign in or create accounts, answer CAPTCHAs or other human checks, or reach other sites or accounts. If your product needs a human step, tell the user, let them complete it on the website, then retry.
Transport and origins
All origins are HTTPS. The OAuth and execution routes answer cross-origin requests from your own pages, so a browser app can call them directly. Console routes require the developer session and the console's origin.
Common questions
- Can WOOL see my users' data? A run reads what your prompt asks it to read, and the result you receive is what it read. Treat results as user data on your side too. Data lists what's stored and what you can delete.
- Can a prompt make WOOL do something the user didn't authorize? No. The connection is the boundary: one account, one website, until the user revokes it.
Next steps
Data lists what WOOL stores and what you can delete.