--mode—open|allowlist|blocklist--tool <toolkit>.enable=A,B/.disable=A,B— per-tool filter (repeatable)--custom-auth <toolkit>=ac_xxx— white-label OAuth (repeatable)
requiresApproval per primitive) is configured
via the dashboard Account Kit editor or the REST API
(primitives_config / connections_config) — see
Approvals. Sensitive actions are gated by default.