Connected applications

Connected applications are outside tools that have been given access to your account's data through the app's API — for example a migration tool that brings your subscription preferences in from another system. This is where an administrator decides which of them are allowed in, what each one may do, and when to take that back. Only admins can see this page.

Clicking "allow" on a sign-in screen does not, by itself, let an application in. When someone on your team connects an application, it arrives here, and your access policy decides what happens next: it can wait for an admin's approval, be turned away, or be approved straight away. Only an application whose status is Active can read or change anything.

What you'll see

The page is titled Connected applications, and you open it from the API applications tab in Settings. It has up to three parts:

• Waiting for approval — applications that have asked to connect and are waiting for an admin. This part only appears when there is something to decide, and it is always at the top.
• Applications — everything else: applications you've approved (Active), ones that were turned away (Denied), and ones that were taken back (Revoked). Denied and revoked applications stay in the list on purpose, so a denial never looks like the application vanished and you keep a record.
• Access policy — the rule for applications that connect from now on.

Each application shows its name, its web address, and the access it asked for as short labels in plain words, such as Read all contacts or Change subscription status. Access that changes data is listed before access that only reads. Hover a label to see exactly what it covers. Under that you'll see who connected it and when, who approved or denied it and when, and when it was last used.

Two different people are shown on purpose. Connected by is the member who connected the application. Approved by (or Denied by) is the administrator who decided. They are often different people, and that is exactly when you want to know.

Steps

Approve or deny a request

1. Open Settings and go to the Connected applications tab. If you're not an admin you'll see a short "Admin only" note instead.
2. Under Waiting for approval, read what the application is asking for. Check the access labels and the web address — the address is the part you can verify; the name is chosen by whoever built the application.
3. Click Approve or Deny. A confirmation window opens (when you approve, it restates the access once more) and you can add a reason. The reason is optional, and it is kept in the audit trail.
4. Confirm. Approving lets the application start working straight away, with exactly the access shown. If it later asks for more, the extra is held back. Denying keeps it in the list as Denied, where you can still approve it later.

Choose who can connect applications

1. At the bottom of the page, under Access policy, pick one of four options. Each explains, in plain words, what it means for people on your team who aren't admins.
2. Click Save.

Changing the policy never affects applications you have already approved, with one exception: Off.

Switch third-party access off

Off is for an incident, or for when you simply want nothing connected. It does two things at once: every application stops working immediately — including ones you have already approved — and nobody can connect a new one, administrators included.

1. Under Access policy, choose Off and click Save.
2. A window names every application that is about to stop. Read it, then click Switch off.

Nothing is revoked or deleted. When you choose another option, approved applications work again exactly as they were. While access is off, a banner at the top of the page says so, and approved applications show Paused instead of Active. Attempts to connect while access is off aren't recorded, so an application that tried during that time has to try again afterwards.

Revoke an application

1. Find the application under Applications and click Revoke.
2. Say why. A reason is required, because it becomes part of the audit trail.
3. Confirm. The application is marked Revoked and stays in the list with your reason.

What revoking does, and what it doesn't. Revoking removes your approval and records who did it and why. The application stops being able to read or change anything straight away.

A revocation is remembered. If the application asks again it is held for approval — even if an administrator connected it, and even if your policy is Anyone can connect. An administrator has to approve it a second time, so undoing a revoke is as deliberate as making one.

What revoking does not do is cancel the sign-in the application already holds with your identity provider. That cannot let it back in here, but it is worth knowing if the same sign-in reaches anything else.

To stop every application at once, including approved ones, set the access policy to Off.

Tips

• Read the access labels before the name. A tool that only needs to record subscription preferences should not be asking to read all of your contacts.
• If you don't recognise an application, Deny it. Nothing is lost: it stays in the list and you can approve it later.
• A request that needs a decision should be answered, not ignored: until an admin acts, the application can't do anything and its developer sees a permission error.
• Use a reason on every decision. Months from now, "approved for the CRM migration, ticket 412" is worth more than an empty field.

FAQ

Q: Why did an application I revoked show up again? A: Revoking removes your approval, but it can't cancel the sign-in the application already holds, so an application that keeps making requests keeps appearing. It is treated as a new application, with one difference: it is never approved automatically. It is held for approval — even if an administrator connected it, and even if your policy is Anyone can connect — or turned away if your policy is Administrators only and the person who connected it isn't an admin. Until an administrator approves it a second time it can't read or change anything, and you can deny it or leave it waiting. Setting the access policy to Off stops every application at once.

Q: What does "Paused" mean? A: The application is approved, but access is switched off, so nothing it sends is being accepted. Choose another access policy and it goes back to Active.

Q: An application says it has no permission for something it asked for. A: An approval covers exactly the access shown on the application's row. If the application later asks for more than that, the extra is held back, and it gets permission errors for it. This page can't widen an existing approval yet, and it doesn't show you when an application is asking for more.

Q: Does "Administrators only" delete the requests it turns away? A: No. They are listed as Denied, and an admin can approve one if it turns out to be wanted.

Q: What happens to applications waiting for approval when I choose Off? A: They stay in the list, still waiting. Nothing they send is accepted while access is off.

Q: Can I see everything an application has done? A: Not yet. The page shows when each application was last used, not a log of its requests.

Q: Who can see this page? A: Only admins. Regular users see an "Admin only" note, because the choices here affect everyone's data.

Related guides

• Settings overview
• Users and permissions
• Integrations and connectors
• The API documentation, written for the developer of an application that connects