Skip to the documentation
Knowledge base

OAuth for third-party clients

Apps register themselves and sign in with PKCE, and you choose the workspace, addresses and permissions each one gets.

Details

  • An app registers itself from the discovery document at /.well-known/oauth-authorization-server and signs you in with PKCE, so there is no key to paste. Before anything is granted the consent screen names the app and the address your access would be sent to, and an address it never registered cannot be approved.
  • You decide what it gets: one workspace, a preset (read only, read and send, or everything your role allows) or any set of permissions, every address you can reach or only some domains and addresses, and for how long. Your role stays the ceiling, and a permission your role loses later leaves the app on its next call.
  • The same token opens the MCP server and the REST API, under the same limits. Account → Connected apps shows what each app may reach, changes it and removes it. Removing or narrowing access applies on the app’s next call, and new permissions show up once it reconnects or reloads its tools. An app connected before approvals existed has to ask again, and its next call says so.