Agent → Nilyo → your accounts.

Three parties, one direction

Your agent (ChatGPT, Claude, OpenClaw, n8n…) talks to Nilyo through the Model Context Protocol. Nilyo talks to your accounts through Unipile's connection layer. Your agent never talks to LinkedIn, WhatsApp or your mailbox directly, and it never receives your provider credentials.

Every request goes agent → Nilyo → connected account, and every answer comes back the same way. Nilyo exposes 170+ intent-named tools; the agent picks one, Nilyo checks that the account belongs to you, runs the action on the provider and returns a structured result.

Signing in: OAuth 2.1, no shared passwords

When you add Nilyo to an agent, the agent registers itself with Nilyo (dynamic client registration) and sends you to nilyo.com to sign in or create your account. The agent receives a short-lived access token and a refresh token, both bound to that agent. Personal tokens exist for runtimes without an OAuth flow, and you can revoke any of them from your dashboard.

Your Nilyo password is never shown to the agent, and neither are your provider passwords.

Connecting an account

Provider accounts are connected through a secure hosted page (LinkedIn, Instagram, Google, Microsoft), a QR code shown in the conversation (WhatsApp, Telegram) or, for a generic IMAP mailbox, credentials that are forwarded once to the connection layer and never stored by Nilyo or the agent.

Each connected account has a stable identity: owner name, identifier (LinkedIn public id, phone number, email address) and status. If a provider drops the session, the account is marked as needing reconnection and the agent tells you how to reconnect the same account, never a duplicate.

Isolation per user

Every Nilyo user gets a dedicated connection scope and an encrypted, scoped API key on the connection layer. A tool call can only reach accounts inside your scope: the ownership check happens on every call, before anything is sent to a provider.

Team plans centralize billing only. Administrators see connection statuses and seats, never message content, and members keep their own scope.

What the agent can and cannot do

Read and write operations are separate tools, flagged with MCP annotations (read-only, destructive, open-world). Sending a message, publishing a post or deleting an email is always an explicit action, and good agents show the text and wait for your approval before calling it.

Nilyo never chooses between two of your accounts: when you have two WhatsApp lines or two mailboxes, the agent lists them and passes the one you named. When a name matches several people, nothing is sent and the agent asks.

Pacing and account safety

Providers watch for automation. Nilyo serializes calls per account and applies daily budgets that mirror normal human usage: about 100 LinkedIn actions per day (including profile views and searches), 20 new WhatsApp conversations per day with 15 seconds between them, about 100 Instagram actions per day. When a budget is reached the agent receives a clear error instead of retrying in a loop.

Bulk requests (“invite 500 people today”) are refused by design and turned into a small, reviewed batch.

What Nilyo stores, and for how long

Nilyo stores your account (email, password hash, plan), the list of connected accounts with their identity and status, agent authorizations and billing records. Messages, emails, profiles and posts are fetched live from the provider when a tool is called and returned to your agent; Nilyo does not keep a copy.

Removing a connected account deletes it on the connection layer immediately. Deleting your Nilyo account removes every connected account, your scope and your key, and cancels the subscription. Details in the privacy policy.

Realtime events

Persistent agents and n8n can subscribe to events (new message, new email, account status) delivered directly to an HTTPS endpoint they control, restricted to the accounts you own. Nilyo manages the subscription; the payload does not transit through Nilyo.