Manage apps

An app, such as a reading app or an AI agent, signs in to your instance and asks for access. It reaches only what the owner approves, and keeps it until the owner disconnects it. A script you run yourself uses a key instead. Access explains what a credential can hold.

Approve an appCopy anchor link

An app that signs in opens its approval page in your browser, headed with its name. An app with no browser, such as the CLI, shows a code instead: enter it on the Connect a device page at the address the app gives, within ten minutes. Sign in as the owner if the page asks.

Marfa can't confirm who made an app, because any program can register with any name. Approve only apps you trust.

1. Read Full access, which the page opens on: what the app asked for, in plain words, with a last line for anything that can't be undone.
2. To give less, select Choose access, which opens a control for each part:
   • Already allowed: what the app held before. Approving never lowers it.
   • Your data: No access, Read only or Read and edit for each item type, up to what the app asked. An app that asks for every type, with *:read or *:write, can be given chosen types instead.
   • Your profile: shown only when the app asks for it.
   • More control over Marfa: each permission starts off. instance.maintain, schema.write and items.purge are marked because they can't be undone.
3. Select Approve, or Cancel to decline.

A request with nothing new to grant shows no choice. Choosing access with everything new off is declining: the app gets access_denied and keeps what it held.

Granting a write or a permission the app doesn't hold needs a sign-in from the last five minutes, so the page asks you to confirm it's you. A program that sends the approval without one gets 403 forbidden and no code.

Narrow or disconnect an appCopy anchor link

Open Connected apps from Home and choose the app. Its page shows what it can reach and the keys it made.

• To narrow it, turn access off under Access and select Save. Tokens and refresh chains that exceed the remaining access end at once, and the rest keep working. The app asks again if it needs more, and wider access needs a fresh approval.
• To disconnect it, select Disconnect. Its sign-in ends at once, and the keys it made keep working unless you also select Also revoke the keys it made.

Both need a sign-in from the last five minutes. Narrowing leaves the keys the app made as they are, so narrow or revoke those as Manage keys shows.

An approval ends when the app goes unused for a year. grant_inactivity_days in Settings changes that period, and 0 keeps every approval. An app disconnects itself as Revoke access shows.

The rules behind this page are in the keys and sign-in chapter of the contract.