How sign-in works
Connecting Thunders to an AI client uses OAuth. You sign in on the Thunders page in your browser and approve the connection there.
Your password is never shared with the AI client. It only ever receives a token.
Tokens refresh automatically, so the connection keeps working without you signing in again.
There is no API key to copy or paste, and nothing to store in a config file or commit to a repo.
What the connection can reach
The connection acts as you. It can see and do exactly what your Thunders account can see and do, no more. Your organization and project permissions apply unchanged.
Access | What that covers |
Read | Projects, apps, test cases and steps, test sets, test assets, test runs and their logs, environments, personas |
Write | Create and edit test cases, steps and labels; create test sets and change their membership; upload test assets; create and update environments and variables |
Execute | Queue test runs |
Delete | Delete test cases |
Actions that ask before they act
Every tool is tagged so your AI client knows whether it is safe to run unattended. Four tools are marked destructive and will always prompt you for confirmation:
delete_test_case, because it removes test cases permanentlyqueue_test_cases, because it starts real test runs and consumes execution creditsapply_test_case_suggestion, because it overwrites the text of an existing stepremove_test_case_from_test_set, because it changes what a test set contains
One safeguard worth knowing: delete_test_case will not delete a test case that another test case reuses. It reports that id back instead and leaves it in place.
Most clients also ask before the first use of any tool that writes. See Available tools for the full read, write and destructive breakdown.
Secrets in test runs
Environment variables marked as secret are redacted before anything leaves Thunders. When an assistant pulls the context for a run, secret values come back as [REDACTED]. Your credentials are never exposed to the AI client or its model provider.
Revoking access
You can cut the connection at any time:
From the AI client, remove or disconnect the Thunders connector in its settings.
Revoking takes effect immediately. Any further tool call from that client fails until you reconnect.