---
title: Connect your agents (n8n, Claude, ChatGPT, code)
description: The steps every platform shares, then which guide to follow for n8n, n8n Cloud, Claude, ChatGPT and custom code.
---
Every platform connects to Veefore the same way: an **agent** with its own
identity, a **tool** that does the action, a **policy** that decides, and a
**runtime** that tells Veefore where the agent runs. This page does the shared
part once. Then follow the guide for your platform.

:::warning Connected is not protected
Veefore controls the actions an agent sends **through** Veefore. A Gmail node
wired straight into an n8n workflow, or a Gmail connector added directly in
Claude or ChatGPT, never reaches Veefore. The **Integrations** page says so for
each runtime: only a Veefore-managed n8n can be *Enforced within scope*; the
rest are *Partial* at best.
:::

## Before you start

You need a Veefore account at [console.veefore.com](https://console.veefore.com)
with the **Developer** role or higher, and about fifteen minutes. All of the
addresses below use the hosted gateway, `https://gateway.veefore.com`.

:::steps
:::step Pick the environment
At the top of the console, choose the environment you are working in, for
example **Development**. Everything you create below belongs to it.
:::
:::step Create one agent per platform
**Agents → New agent.** Name it after where it runs ("Support n8n",
"Claude Code — ops", "Sales GPT"), grant the capability its actions need, for
example `email.send`, and create it.

Copy the **private key** and **key ID** now. They are shown once. Store them in
your password manager. One agent per platform keeps each one's status and
audit trail separate.
:::
:::step Register the tool
**Tools → New tool.** For an action Veefore performs itself (the strongest
option), choose **HTTP**: the endpoint URL, the method, the destination
allowlist, and a credential.

Add the credential first under **Credentials → New** (API key or bearer token).
The secret is sealed in Veefore's broker; the agent and the platform never see
it. See [Register a tool](/build/register-a-tool) and
[Broker a credential](/build/broker-a-credential).
:::
:::step Authorize the agent on the tool
On the tool's page, **Agents → Authorize**, and pick the agent. Holding the
capability is not enough; the tool must be authorized too.
:::
:::step Write and activate a policy
**Policies → New policy**, for example "Email: block outside domains, approve
anything marked URGENT, allow the rest". Bind it to the workspace, add a test
case, and **Activate** (this needs a step-up). See
[Write your first policy](/build/first-policy).
:::
:::step Turn on enforcement
A new environment starts in **Observe**, which records but blocks nothing.
When you are ready, switch it to **Enforce** from the environment switcher or
with `veefore deploy --mode ENFORCE`. See
[Enforcement modes](/concepts/enforcement-modes).
:::
:::step Register the runtime
**Integrations → Add** on the card for your platform, and choose the agent.
This is what lets Veefore show whether the agent is connected and how far its
actions are enforced. The runtime starts *Pending* and *Unverified*.
:::
:::

## Which guide next

| Where the agent runs | How it connects | Guide |
| --- | --- | --- |
| n8n you host yourself | The Veefore node, plus workflow verification | [n8n (self-hosted)](/build/n8n) |
| n8n Cloud | n8n's MCP Client Tool, until the Veefore node is verified | [n8n Cloud](/build/n8n-cloud) |
| n8n run by Veefore's profile | Hardened deployment that fails closed | [Veefore-managed n8n](/operate/managed-n8n) |
| Claude Code, Claude Desktop, Cursor, VS Code | Veefore's MCP endpoint with an MCP key | [Claude and MCP clients](/build/claude) |
| ChatGPT custom GPTs, other OpenAPI platforms | The Veefore relay you run | [ChatGPT](/build/chatgpt) |
| Your own code | The JavaScript or Python SDK | [Protect an agent](/build/protect-an-agent) |
| Anything else | The `veefore.action/v1` envelope | [Other platforms](/build/third-party-agents) |

## Check it worked

For every platform, the proof is the same three places:

1. **Actions** lists the call with its decision. A refused call shows the rule
   that refused it.
2. **Integrations → your runtime** shows **Connected** once Veefore has seen
   the agent, and its enforcement status with the reason.
3. **Audit** has the event, with the runtime and, for n8n, the workflow and
   execution ids.

## Related

:::cards
:::card Enforcement status | /concepts/enforcement-status
What each status means and how it is computed.
:::
:::card Bypass prevention | /secure/bypass-prevention
Every way around Veefore, and what is done about it.
:::
:::