AI agents for customer support · Part 6 of 14

Connecting your helpdesk, store and billing

What the agent needs to read for each kind of ticket, three ways to connect it, and why it starts with keys of its own that only read.

Aakash William

20 October 2026 · 4 min read

The short version

Your agent can only answer “where’s my order?” if it can read the order. Connect only what your ticket reasons need, and give the agent keys of its own that read before they change anything. Four steps:

Map what each ticket needs
Choose how to connect
Give it its own keys, read-only first
Check who is asking

Step 1Map what each ticket needs

Start from the ticket reasons you chose in part 1. For each one, list the fields the agent must read to answer without guessing, and the system that holds each field.

Where’s my order?

Helpdesk: who is asking: signed in?
Store: order, items, status
Shipping: carrier, tracking, delivery date

Damaged item, wants a refund

Helpdesk: the photo they sent
Store: what was paid, delivery date
Billing: payment, earlier refunds

Cancel my subscription

Helpdesk: earlier contacts about cancelling
Billing: plan, renewal date, last payment

Change my address

Helpdesk: the new address, in their words
Store: order, address
Shipping: with the carrier yet?

Four ticket reasons and the fields each one needs, as an example. The fields in colour change by the hour, so the agent reads them live, from the system that owns them.

A copy synced overnight answers yesterday’s question (part 5). And the store isn’t always the owner: Gorgias notes that a shipping tool such as ShipStation may have fresher fulfillment details than Shopify. For subscriptions, the owner is whatever runs your billing: it holds the plan, the renewal date and the payments, so a cancellation question is read there.

Step 2Choose how to connect

There are three ways in. What differs is who picks the fields the agent can read.

1 Built in

The helpdesk’s own integration.

Who picks the fields: the vendor.

2 A connector you set up

An API call you configure.

Who picks the fields: you, in its settings.

3 Your own tools

Lookups you write and run.

Who picks the fields: you, in code.

Three ways to connect the same store. The further down, the more you choose, and the more you keep running.

In practice: on Gorgias, connecting your Shopify store gives the agent your orders. On Intercom, you add a data connector for each lookup, starting from a template such as Shopify’s order lookup; its Stripe templates only read. On Zendesk, you give the AI agent an API call step that asks your store for the order. If you build your own (part 3), each lookup is a tool you write. Whichever way, list the fields from step 1 and check that the connection returns them.

Step 3Give it its own keys, read-only first

Make a key for the agent alone in each system, with only the access its tickets need. Then you can see what that key did, and switch it off without touching your team’s access.

The agent’s own key for your store

Orders: Read: status, items, what was paid
Customers: Read: name, email, address
Tracking: Read: carrier, tracking number
Refunds: None. Write comes later, one action at a time (part 7).

The agent’s own key for the store, as an example. It reads what its tickets need. Each write, such as a refund, is added later, one action at a time.

Stripe’s restricted keys work this way: each resource is set to None, Read or Write, and on a new key every permission starts at None. Shopify splits orders into read and write access, and both reach back only 60 days. Older orders need a separate scope, read_all_orders, which you ask Shopify for. If your agent can’t find an order from last spring, look there first.

Step 4Check who is asking

An order number in the chat says which order, not who is asking, and anyone can type one. So the agent’s lookups should take the customer from a login or a one-time code, never from the conversation.

Trusting the chat

The customer types “Where’s order #1042?” → the lookup searches by the number typed → any customer’s order #1042

Trusting the login

The customer signs in, or enters a one-time code → the lookup searches by the signed-in customer → only their own orders

The same question, looked up two ways. When the lookup trusts the login, a number typed in the chat opens nothing that isn’t the customer’s own.

For people its Messenger hasn’t signed in, such as new visitors or other channels, Intercom’s guidance for its data connectors is that “you should use one-time passcodes (OTP) or another secure verification method before exposing any user data”.

Intercom, “Data connectors FAQs”

With the right fields, read by the right customer, the agent can answer. Changing anything is the next decision, made one action at a time.

Next in this series

Part 7: giving the agent actions: refunds, cancellations, address changes. See all 14 parts.

Sources

Shopify, “Shopify API access scopes”, read on 20 October 2026.
Stripe, “Restricted API keys”, read on 20 October 2026.
Intercom, “Data connectors FAQs” and “Use Data connector templates”, read on 20 October 2026.
Zendesk help, “How can I link my AI agent with my customer orders?”, read on 20 October 2026.
Gorgias, “How Gorgias’s AI Agent works” and “AI Agent Actions: Connect AI Agent to ShipStation”, read on 20 October 2026.

Why we write these guides