Apps and access

The Apps and access area is the list of everything that holds access to your account other than your own sign-in. An application you allowed to sign you in is there, a script you gave a token to is there, and an application you registered yourself is there. For each you can see what it holds and take it back.

It is for any account owner who has clicked Allow on an application's consent screen, and for the smaller group who write scripts or build applications. If you only use applications, the Connected apps tab is the one that matters.

There are four kinds of access, and they differ in who is acting. The Agents tab lists the non-human agents that act for you inside an organization, and lets you revoke them; see Connected apps. A connected app is a third-party application that signs you in and sees only the scopes you granted. A personal access token is a long secret you made for yourself so that a script can read and update your own profile, and nobody else is involved. A developer app is an application you register so that it can sign other people in. Applications that TDACorp ships itself are never shown the consent screen and do not appear in the list.

Connected apps     other people's apps  ->  you allowed them, on the consent screenAccess tokens      your scripts         ->  a secret you created, expires on the date you choose or neverDeveloper apps     your own apps        ->  you register them (In development)

Revoking is always available and takes effect on the application's refresh tokens at once. An access token an application already holds can keep working until it expires, which is at most 15 minutes.

I want to see what I have allowed.

1. Connected apps: read the scopes each application holds.
2. Scopes and consent: what each scope shares.
3. Connected apps: revoke the ones you no longer use.

I want a script to update my profile.

1. Access tokens: create a token with the least access it needs.
2. Using an access token: call the profile address with it.
3. Access tokens: revoke it when the script is retired.

I am building an app and want to register it myself.

1. Developer apps: see whether the tab is available to you.
2. Choosing an integration: which kind of client fits.
3. Quickstart: sign in once.

Connected apps answers what the Allow access screen shows (the application's name, whether it is verified, what it asks for, which items are Required), what an application may see for each standard scope, and what revoking does and does not do. It does not end your own TDACorp session.

Access tokens answers how to create, rename and revoke a token: the name, an expiry (30, 60 or 90 days, never, or a custom number of days from 1 to 365), the organization it acts in, the scopes (grouped by area, from read-only to full access) and an optional list of allowed addresses. It explains that the secret is shown once and what the badges Active, Revoked, Expired and Inactive mean.

Using an access token answers where a token works, which is one address only, the profile route, how to send it, how to read and update the profile, and the failures you may see. It notes that using a token is available where your organization allows it.

Developer apps answers what the tab does today: it registers simple apps of your own that sign people in, as public clients with no secret. This feature is In development, and it is available where your organization allows it.

Managing access tokens needs a second factor you used in the last 30 minutes, and a token acts inside an organization where you are an active member. If you have none, the New token page asks you to accept an invitation first. Registering a developer app needs a personal workspace on your account.

Does revoking an app sign me out of TDACorp? No. See Connected apps.

Why do some apps never ask me to allow them? Applications TDACorp ships itself skip the screen. See Consent.

Can I see my token's secret again? No. It is shown once. See Access tokens.

Can a token do more than I can? No. It carries only access you hold in that organization at that moment. See Access tokens.

Which parts of the account API accept a token? Only the profile route. See Using an access token.

It does not cover how to build an integration, which is in Build with identity, or the full list of account API routes, which is in the Reference. Why scopes exist and how they differ from permissions is in Concepts.