Connected apps

When an application asks to see your account, the sign-in stops on a screen headed with the app's name, for example Allow ExampleApp to access your account? It says "It will be able to see what you allow below." and tells you whether the application is verified: Verified application, or This application is not verified by TDACorp. Under This application is asking for it lists what the app wants. Links to the app's Privacy policy and Terms of service are shown where it provides them. An application that is identified only by a web address (a client ID metadata document, behind the oauth_cimd feature flag, which defaults OFF) also shows the line It is identified only by its web address: followed by that address, so you can check who is asking.

• Items marked Required cannot be unticked. Every application needs to confirm who you are.
• Other items start ticked, and you can untick the ones you do not want to share. A request for something the platform does not recognise starts unticked.
• Allow continues the sign-in. Deny refuses it.

If an allowance you gave earlier already covers what an application asks for, you are not asked again, unless the application asks to show the screen anyway. Applications that TDACorp ships itself (first-party applications) are never shown this screen, so they do not appear on Connected apps either. The screenshot below shows sample applications.

Each allowance lists the scopes you granted. A scope is a named piece of access. These are the standard ones, in the words the sign-in screen uses.

An application can also ask for a scope named after itself. That lets it use your permissions in that product, limited to what your role there allows. The full list of scopes the platform accepts is under Scopes.

An application never receives your password. It receives what the scopes above release.

1. One allowed app, with the date it was allowed.
2. What the app may see: the scopes you granted, one chip each.
3. Revoke access, on the same row.

Open Apps and access in the account navigation. The Connected apps tab is the first, and its list is titled Allowed apps. Each row shows the app's name, Allowed on with the date, and the scopes it holds as chips. A chip shows the scope's own name, such as openid or email.

An application registered by TDACorp for the whole platform and not for one organization is shown by its client identifier instead of a friendly name.

On a phone the apps stack one under another.

If you have not allowed any application, the page says No connected apps and that an app appears after you allow it to sign you in.

The dialog says the application loses the access you gave it, and that you can allow it again the next time it asks.

What revoking does:

• it removes your allowance, so the next sign-in through that application shows the Allow access screen again;
• it ends the refresh tokens that application held for you, and the application is notified that those sessions ended.

What it does not do: it does not affect other applications, and it does not end your own TDACorp session or any browser session. To end browser sessions, see Sessions.

The Agents tab, next to Connected apps under Apps and access, is titled Agents acting for you: "Agents you own, the organization each works in, and whether it may pass its authority on. Revoke one to stop it." An agent is a non-human account that acts on your behalf inside one organization, set up by an administrator with you as its owner. Reading this tab needs a second factor you used in the last 30 minutes, like the account pages that change how you sign in, and it is not available to an account an organization manages.

The list is titled Your agents. Each row shows the agent's name, a status badge (Active, Suspended or Revoked), Organization: and its name, Created with the date, Last used with the date or Never used, and Can pass on its authority when it may delegate. An agent appears only while you are still a member of its organization. With none, the page says No agents and that agents that act on your behalf appear here.

To stop one, select Revoke agent on its row. The dialog Revoke this agent? says It stops working at once, and its tokens and sessions end. This cannot be undone: a new agent has to be set up if you want one again. Confirm with Revoke agent. A revoked agent stays in the list with no button.

• Access tokens: tokens you create yourself, which are not applications.
• Notifications: a new allowance is a security event in your feed.
• Build with identity: for people who build an application that signs people in.