docs: document blank connector tokens and user_verify_url exchange failure

[ekline]

Problem

Developers integrating AgentKit outbound connectors hit three authorization failures that were under-documented in the troubleshooting guide:

1. failed_to_exchange with user_verify_url not configured for verification redirect. The troubleshooting page's failed_to_exchange_token scenario did not name user verification as a cause or link to the fix.
2. Blank tokens: a new connection returns a connected account id (e.g. ca_...) but empty access/refresh token fields. Not documented anywhere. Root cause: returning raw tokens in API responses is disabled by default for security and must be enabled per account by Scalekit.
3. Cross-account failure (OAuth app works only for the account that created it). Already well covered on the page, so no change needed.

Audience

A developer integrating AgentKit outbound connectors (intermediate) whose agent connects to third-party tools (Airtable, ZoomInfo, Google Drive) on behalf of their own and their customers' end users. Goal: authorize outbound connectors for their own and external/customer accounts and actually receive tokens back.

Gravity

HIGH. 3 distinct customers, production, recurring. Category: mixed (docs gap + product).

Scrubbed customer quotes

• "it works with the same account where the app was created, but not with other/external accounts"
• "it's returning the connection but not the tokens"
• "can we please hide/remove the pre-filled Client ID? It gives the impression that DCR is supported"

Fix (this PR)

Edited the AgentKit connection troubleshooting page only:

• Enriched the failed_to_exchange_token scenario to name the user_verify_url not configured cause, state that user verification is a required security step enabled by default in production, and link to the user verification guide.
• Added a new "Connection returns an account id but tokens are blank" scenario explaining that raw provider tokens are withheld by default for security, that execute_tool/executeTool injects tokens automatically, and how to request token retrieval via support.

Cross-account coverage already exists on the page, so it is left unchanged to keep the diff minimal.

Follow-ups / product (not docs-fixable)

• Pre-filled client_id on Scalekit-provided connectors wrongly implies DCR is supported. Consider hiding/removing it or labeling it clearly. Customer quote: "can we please hide/remove the pre-filled Client ID?"
• A hosted "connect" widget / pre-check screen appeared by default after a platform change, with no self-serve toggle (support disabled it per-environment). Add a self-serve toggle. Note: magic-link/hosted widgets work for OAuth connectors only, since non-OAuth connectors need to collect input such as API keys.
• Consider a product-side default or self-serve toggle for token retrieval so developers who genuinely need raw tokens are not blocked on support.

Preview

https://deploy-preview-{PR_NUMBER}--scalekit-starlight.netlify.app/agentkit/authentication/troubleshooting/

ekline[bot] <202747777+ekline[bot]@users.noreply.github.com>

---

📝 Created with EkLine · View session

[netlify]

✅ Deploy Preview for scalekit-starlight ready!

Name	Link
🔨 Latest commit	7358271
🔍 Latest deploy log	https://app.netlify.com/projects/scalekit-starlight/deploys/6a455433be9f6d000854c628
😎 Deploy Preview	https://deploy-preview-819--scalekit-starlight.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 49 (🟢 up 11 from production) Accessibility: 98 (no change from production) Best Practices: 92 (no change from production) SEO: 92 (no change from production) PWA: - View the detailed breakdown and full score reports
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.