Connected Apps overview
Link external apps to Ethen — connect, grant least-privilege scopes, approve sensitive actions, revoke anytime.
Connected Apps link your Ethen identity to external apps — one connection per account — so Chat and automations can act there on your behalf. Every grant is least-privilege, every sensitive action pauses for approval, and every connection can be revoked.
Connect
- Open Chat settings and find Connected Apps.
- Pick an app from the catalog. Apps that are catalog-only (not yet certified for your use) are labeled as such — never presented as available.
- Review the connect sheet: it shows the exact scopes requested, the OAuth client, and what each scope allows.
- Authorize at the provider. Ethen stores credentials in the managed vault — never in your browser, never in a chat log.
Connect requests the required scopes for the task, not the whole catalog. Unknown or unregistered scopes are rejected, never silently granted.
Scopes
Four scope sets stay distinct:
| Set | Meaning |
|---|---|
| Registered | Everything the connector manifest declares |
| Requested | What this connect flow asks for |
| Granted | What you approved |
| Enabled | What is currently usable |
Absence from granted or enabled is meaningful: a missing scope means "not allowed", never a default allow. Incremental grants add scopes later without re-connecting from scratch.
Approvals
Sensitive actions pause for your approval before running. An approval names the exact action, the exact account, and the exact scopes it will use. Changed actions need fresh approvals; expired approvals need re-approval. Standing approvals can pre-authorize narrow, repeatable actions — see Managing connections.
Revoke
Disconnect any connection from settings at any time. Revocation removes the binding immediately; the underlying provider grant is released when its last live binding goes away. A revoked connection fails closed — pending actions on it do not run.
Availability honesty
Connected Apps providers certify one by one. The launch set and each provider's certification state are tracked in the Flow release process — a connector listed in the catalog is not automatically certified for your account. Setup-required and partial states are labeled, never collapsed into "available".