Connected apps

Third-party applications can connect to your organization with OAuth2 instead of an API key: an administrator approves the application once on a consent screen, choosing at the same time who may sign in to it with their Xyte account. Connected apps lists every application that has been approved this way and lets you disconnect it.

To open it, navigate to Settings in the left-hand menu and select the Connected apps tile. The tile is shown to organization administrators, and appears once Xyte has enabled it for your partner's portal; contact support if you do not see it.

What the list shows

For each connected application you can see:

• Application: the application name, as registered with Xyte.
• Who can sign in: the sign-in policy the approving administrator chose — Anyone with access, Members of group name, or Administrators only. Administrators only (group deleted) appears when the group a connection was limited to has since been deleted.
• Authorized by: the administrator who approved the application for your organization. Partner administrator is shown when a partner or Xyte administrator connected the application on your behalf.
• Authorized on: when the application was connected.
• Last used: when the application last called your organization's data. Shows Never until the first call.
• Users: the users who signed in to the application with their Xyte account, shown as None or a count such as 3 users. Click it to list each user's email address and when they last used the application.

Only applications an administrator has approved appear here. Until then, users of the organization see the application's consent screen list your organization under Requires administrator approval, and cannot pick it.

The sign-in policy is chosen when the application is connected, and it only ever narrows who may sign in — an administrator of the organization is always admitted, and can always approve:

• Anyone with access to the organization (the default) — every user who can reach the organization in Xyte can sign in to the application. Nothing to maintain, and nothing to stop a new user from using it on day one.
• Only members of a group — only users in the one group you name. The tightest fit for a departmental tool, but it is a second list to keep up to date: someone who leaves the group loses the application, and if the group is deleted the connection falls back to administrators only.
• Only organization administrators — nobody else can sign in. Safest for an application you would rather keep out of everyday hands, at the cost of asking an administrator whenever someone needs it.

This column is read-only. Changing the policy of a connection means revoking it and approving the application again — which also signs out everyone currently using it — so it is worth getting right at approval time. Narrowing it later does not cut off tokens the application already holds; only revoking does.

🚧

Approval decides the access, and who may sign in

An approved application acts with your organization's full administrative access on every sign-in, including sign-ins by users who are not administrators. Signing in does not narrow what the application can reach. The same approval also settles who may sign in through the connection — anyone with access to the organization, the members of one group, or administrators only. Approve only applications you trust with the whole organization's data, and choose the narrowest sign-in policy that still lets the right people in.

Revoking an application

To disconnect an application, open the row menu, choose Revoke access, and confirm. Revocation takes effect immediately:

• Every access token and refresh token issued to the application for your organization stops working, whichever of your users obtained them.
• Everyone signed in through that application is signed out. Your users can no longer use it with their Xyte account.
• The application receives 401 on its next call and has to be approved again, by an administrator, before it can access your data. Until then your organization shows up under Requires administrator approval on its consent screen.

📘

Note

Revoking only disconnects the application from your organization. The application itself is not affected for other organizations, and your Core API Keys are not touched. To manage those, see API Keys.

Call Log

Calls made by a connected application appear in the Call Log tab under API Keys, alongside calls made with your keys. The Credential column shows the application name with an OAuth badge in place of a key name, and the name of the user who signed in appears under the application. Use it to check what an application is doing before you revoke it.

For developers

The OAuth2 flows, token lifetimes and endpoints are documented in the API reference under OAuth2 & OpenID Connect.