Integration guide
One sign-in, one command, and a choice of where the work runs.
If your team has its own agent, it can hand spreadsheet work to Shortcut by running the shortcut command on the user's machine. Your agent never handles API keys or tokens; Shortcut takes care of sign-in, and your agent chooses where each task runs.
Your agent only needs to know one thing: how to run the shortcut command. Every task then goes to one of two places.
Each user signs in one time. Shortcut stores and refreshes the sign-in on that machine, and every later call runs as that user, with that user's permissions and skills. Your agent never sees a token or a key.
# Install once (Node.js 22.12+)
npm install -g shortcutxl
# Each user signs in once
shortcut loginshortcut api sends the task to the Platform API. One command uploads the files, waits for the work to finish, and downloads the result. Because the work happens in Shortcut's cloud, it cannot see the user's desktop, installed Excel add-ins, or company network; anything the task needs must be sent with it. The full command list is in the Platform API guide.
shortcut api run "Combine these regional sheets and add a summary pivot" \
--input q3-sales.xlsx \
--output q3-report.xlsx \
--json
# List what the signed-in user can use
shortcut api skills
shortcut api runsshortcut -p does the work on the user's machine, in desktop Excel itself (Windows with desktop Office). Choose this when the task depends on anything that lives on that machine: installed add-ins, macros, workbook links, local files, or data that only the company network can reach. The --mode json option makes the output readable by your software, one event per line.
# --skip-office-permissions lets the run proceed with no one at the
# keyboard to approve; see Approvals below before enabling more.
shortcut --skip-office-permissions -p \
"Refresh the model and update the summary tab" --mode json
# Continue the same piece of work across calls
# (every run prints a session id to reuse)
shortcut --skip-office-permissions --session a1b2c3d4 -p \
"Now add a sensitivity table" --mode json
# Read-only analysis instead of editing
shortcut --agent-mode ask -p "Audit this model for errors" --mode json| The task needs | Use |
|---|---|
| Excel add-ins, macros, workbook links, local files, or company-network data | Option 2 (the user's Excel) |
| To finish on its own while the user does something else | Option 1 (cloud) |
| The user's personal and team skills applied to uploaded files | Either |
| A machine without desktop Excel installed | Option 1 (cloud) |
When a person uses Shortcut, it asks before sensitive actions. When your agent runs it, no one is there to answer, so approvals are decided ahead of time:
--skip-office-permissions lets a local run work in Excel without asking for each action during that session.--skip-runtime-permissions also stops it from asking before touching files or running commands. This is a deliberate security decision: use it only where your agent already controls what is allowed to run on the machine.Cloud runs need neither: the work happens in Shortcut's cloud, away from the user's files and programs.
Next step
Tell us where your agent runs and what your users' workbooks depend on, and we will help you pick the right path.