# Allow and revoke connected applications

After this page, you know what you decide on the **Allow access?** page and which third-party programs may act on your behalf — and how to take that back with one click.

> **Type:** guide
> **For:** every person with an account in the portal who lets a third-party program work with Szenera
> **Prerequisite:** no particular role, since it concerns your own access and permissions you already hold yourself
> **Where in the portal:** **Settings › My account › Security**, **Connected applications** card

A third-party program, such as an assistant, a command-line tool, or an app on your computer, can work with Szenera on your behalf. It never receives your password. You confirm a page once, and from then on the program acts with exactly the permissions you gave it.

**Connected accounts and connected applications are not the same thing.** A connected account is a way *for you to get in* (Google, Apple, the company account). A connected application is an authorization *you have granted*. That is why they are on two separate cards. The first one is covered in [Connected accounts and active sessions](/docs/organization/connected-accounts).

## Steps

### Give an application access

A connection is not created in the portal but in the application, and there is deliberately no button for creating one here. The program sends you to your browser, you sign in to Szenera if you are not already signed in, and you see the page **Allow access?**

1. Read the subtitle: **… wants to act on your behalf in ….** It names the application and the organization.
2. Under **Returns to**, check where it goes afterwards.
3. Under **This application receives**, read the **areas** that are requested, such as **Scenes**, **Media**, or **Displays & locations**. Under each name is a sentence on what the application can do there.
4. Switch off what the application should not get. Each area has a switch, and all requested areas are switched on at the start.
5. Decide by clicking **Allow** or **Decline**.

**You can also grant only part of the access.** The application then gets exactly the areas that stayed switched on, and no more. Keep in mind that a switched-off area will be missing for the application later: At the point where it needs the area, it reports that the approval does not include it. To switch the area on afterwards, revoke the access and allow it again the next time.

If you want to know more, expand **Show all … permissions** under an area. The individual permissions appear there in plain language. They can be deselected only by area, because a single missing permission would make an application fail at a point you no longer associate with this page.

The note below the areas draws the other boundary: **The application can never do more than you can — and never more than what is switched on here.** If you switch everything off, **Allow** turns gray, and a note above it says why.

Permissions that you do not hold yourself or that are never passed on appear in their area with their reason: **You do not hold this permission yourself.** or **This permission is never available to third-party applications.** An area in which nothing can be granted shows the badge **Cannot be granted** instead of the switch. If nothing is left at all, it says **None of the requested permissions can be granted. The application receives no access.**

If you belong to several organizations, the approval applies to the one you are currently signed in to (**Access applies only to the organization named here.**). **Choose another organization** lets you switch before you decide.

### See what is allowed

1. Open **Settings › My account › Security** and go to the **Connected applications** card (“Third-party programs you gave permissions from your own set.”).
2. The table has four columns: **Application**, **Receives**, **Granted**, and **Last used**. If it says **Never** there, the application has not used its access since it was allowed.
3. Under **Receives** is the tally, such as **5 areas, 18 permissions**. A click on it expands the same areas you saw when allowing, each with the permissions the application actually holds in it. The explanatory sentences of the consent page are deliberately not shown here. There they describe an area that is being requested, whereas here it is about what was actually granted, and that is often less. If an application holds no permission at all, it says **No permissions**.
4. There is one row per **application**, not per sign-in. If an application has several grants, such as on two computers, its name shows the count as a badge (**2 grants**).

Without a connection, the card says **No connected applications.**

### Revoke access

1. Click **Revoke** in the row.
2. Confirm the **Revoke access?** prompt: “… loses every grant immediately — on every device it is signed in on.” The button is labeled **Revoke**.

The revocation affects **everything** you gave this application, not only the most recent access. The effect is immediate. The application’s next call fails. If you want to use it again later, you go through **Allow access?** once more.

> **If you do not recognize an application, revoke it.** No harm is done if you are wrong. You allow it again the next time.

## Options

An application can never do more than you can. If you later lose a permission, the application loses it at the same moment. It keeps no authorization that was taken from you.

Every approval and every revocation appears in your organization’s [change log](/docs/organization/read-change-log), with the application and with you as the person who decided. If an application later acts on your behalf, the log shows it as the originator and names you behind it.

## Check the result

- After **Allow**, you land back in the application, and the **Connected applications** card shows a new row with today’s date under **Granted**.
- After **Revoke**, **Access revoked** appears, and the row disappears from the table.

## If something goes wrong

| Symptom | Meaning | Solution |
|---|---|---|
| **Delegated access by third-party applications is switched off for this organization.** | Your organization does not allow third-party applications. | Ask a person with the Owner role. |
| **The application requests permissions you do not hold yourself.** | An authorization can never contain more than your own set. | Have the missing permission granted to you: [Who can do what in the portal?](/docs/organization/about-roles-and-permissions) |
| **The application requests permissions that are never available to third-party applications.** | Certain permissions can never be passed on. | Ask the provider of the application which permissions it really needs. |
| **This request has expired.** or **This request has already been decided.** | The page applies only to a single, fresh request. | Start the process in the application again. |
| **This address carries no request.** | The address was opened without a request, for example from a bookmark. | Start the process in the application that sent you here. |
| The application reports that the approval does not include a particular area | That area was switched off when you allowed access. | Revoke the access and allow it again the next time with the area switched on. |
| The **Connected applications** card is empty although you agreed | The approval applies per organization. You are looking at a different one. | Switch to the organization you agreed for. |

## Related

- [Connected accounts and active sessions](/docs/organization/connected-accounts) — the other card on the same page: your sign-in methods and devices.
- [Who can do what in the portal?](/docs/organization/about-roles-and-permissions) — where the permissions you can pass on come from.
- [Create, rotate, and revoke an API key](/docs/developers/create-api-key) — the other way to connect a program of your own: without a person behind it.