Consent

You are asked when an application is third party, meaning it is not one that TDACorp ships itself. A first-party application is never shown the consent screen, because a screen asking you to allow TDACorp's own software would be theatre. It also does not appear on your Connected apps page.

For a third-party application, identity checks, on every sign-in, whether you have already allowed everything it is asking for.

An unrevoked consent that covers the request is enough. It is never time limited by identity: it lasts until you revoke it.

The screen is titled Allow access and its heading names the application: Allow ExampleApp to access your account? It says It will be able to see what you allow below.

• Verified application appears when TDACorp has verified the application. Otherwise the screen says This application is not verified by TDACorp. Treat that line as a warning. An application that identifies itself only by a web address (a client ID metadata document, flag oauth_cimd, default OFF) also shows It is identified only by its web address: followed by that address.
• Under This application is asking for each scope is listed as a short title and a plain description. See Scopes and consent for the wording of each.
• Required marks what cannot be unticked. Only openid is required, because without it there is no sign-in. The other items start ticked and you can untick any you do not want to share.
• Links to the application's Privacy policy and Terms of service can appear.
• Allow continues, and Deny refuses.

What you leave ticked is what the application gets. The sign-in is completed for the scopes it requested that you also granted, plus openid. An application that asked for your email address and was refused it receives a sign-in without an email address, and has to cope.

If you select Deny, the application is sent back with the standard error access_denied.

When you select Allow, identity stores which application and which scopes you granted, and when. That is a consent. It is the basis for both skipping the screen next time and for the list on Connected apps.

Open Apps and access in your account. The Connected apps tab lists each allowed application with Allowed on and the scopes it holds. Select Revoke access and confirm. The steps are on Connected applications.

Revoking consent has these effects.

• The application's refresh tokens for your account end. Their families are revoked, so it cannot get new access tokens. See Token families and refresh rotation.
• A back-channel logout is sent to the application, if it registered an address, so it can end its own session for you.
• The next sign-in asks again. The application can ask again, and you can allow it again. The dialog says so: You can allow it again the next time it asks.
• Your TDACorp session is untouched. Other applications keep working, and you stay signed in.

An access token the application already holds can keep working until it expires, which is at most 15 minutes, unless the API behind it asks identity whether the access still stands. This is one reason access tokens are short lived. See Sessions and tokens.

• It is not permission to do things in a product. Consent lets an application see your account. What you may do in a product is decided by your role there. See Authorization.
• It is not a login. Allowing an application does not give it your password, passkey or session. It only ever receives tokens.
• It is not shared between applications. Each application has its own consent.

• Scopes and consent
• Connected applications
• Privacy