they shouldn't have to access your account - just the workspace their bot is deployed in