Skip to main content
Integrations · Hex
A Guild agent can trigger Hex project runs, edit notebook cells, manage workspace resources, and drive Hex agent threads without leaving your automation workflow. Guild stores your Hex API key server-side so the key never appears in agent code, prompts, or logs. Credential policies let you restrict which operations each agent may call, and every request is auditable through Guild’s credential proxy.

Book a demo

See how teams govern agents that use Hex.

Talk to sales

Get access to Guild, then connect Hex to your first agent.

What the Hex integration exposes

The integration package guildai~hex provides tools covering Hex projects, notebook cells, project runs, data connections, collections, groups, users, and agent threads. Tools follow the hex_ naming prefix. Use pick() to load only the tools your agent needs rather than the full set.

How it works

1

Get a Hex API key

In Hex, go to Settings > API keys and generate a key. A Team or Enterprise plan is required.
2

Connect the credential in Guild

In Guild, go to Access & setup > Credentials, click Connect, select hex, and paste the key into API Key. See Credentials for workspace, member, and agent-scoped options.
3

Add HexTools to your agent

Import HexTools from @guildai-services/guildai~hex and spread it into your agent’s tools object. Guild sends the key as a bearer token in the Authorization header on every call.

Why Hex access needs governing

The Hex integration can deactivate users, delete cells, update project sharing, and trigger runs against published notebooks. Without controls, any agent with the credential can make those changes across the entire workspace. Guild’s credential policies let you write ALLOW and DENY rules that the credential proxy enforces before any request reaches Hex. You can restrict a credential to read-only operations, limit it to specific agents or workspaces, or block destructive tools such as hex_deactivate_user and hex_delete_cell by name or pattern. Guild stores the Hex API key server-side and injects it at the proxy layer, so agent code never sees the secret. You can scope a credential to one workspace, one member, or a single agent using the options on the Credentials page. A workspace can also be restricted to its own credentials, preventing shared account credentials from reaching it. Because all requests pass through the proxy, every call is logged there rather than left to individual agents to record.

About the Hex integration

Agents can create, run, and manage Hex projects and notebooks, including editing cells and triggering project runs. They can manage workspace resources such as data connections, collections, groups, and users. Agents can also start and continue Hex agent threads and review context suggestions. The integration is guildai~hex.

Authentication

  • Type: API key
  • Header: Guild sends the key as a bearer token in the Authorization header

Setup

1

Connect Hex

In Guild, go to Access & setup > Credentials, click Connect, select hex, and paste the key into API Key.
See Credentials for workspace, member, and agent-scoped credentials.

Usage

Selecting specific tools

Tools are named with the hex_ prefix. Use pick() to include only what your agent needs.

Tools

Tools in the latest published version of guildai~hex:

Frequently asked questions

No. The catalog entry for guildai~hex lists no webhook events, so the integration does not support event-triggered runs. Agents must poll run status using tools such as hex_get_run_status or hex_get_project_runs.
Write a DENY rule in the credential’s credential policy targeting hex_deactivate_user and hex_delete_cell by name. DENY rules take precedence over any ALLOW rules, so those operations are blocked even if a wildcard ALLOW is also present.
Yes. Connect a dedicated credential from the installed agent’s page, or grant an existing credential to that agent alone. Guild’s credential resolution checks agent-dedicated and granted credentials before falling back to workspace or account credentials, so that agent will always use its own key.
Guild stores the key and injects it as a bearer token in the Authorization header inside its credential proxy. The key never enters the agent’s code, container, prompt, or state, as described in the security architecture and Credentials docs.

Put a governed agent on Hex this week

Book a demo

See how teams govern agents that use Hex.

Talk to sales

Get access to Guild, then connect Hex to your first agent.
Also runs on Guild: Airtable · BigQuery · Nexla · PostHog Read: Docs: Credential policies · Credentials · Tools in agents
Last modified on November 10, 2026