# Manage apps (/run/manage-apps)

Approve what an app may reach, give it less than it asks for, and narrow or disconnect it later.



An app, such as a reading app or an AI agent, signs in to your instance and asks for access. It reaches only what the owner approves, and keeps it until the owner disconnects it. A script you run yourself uses a [key](/run/manage-keys) instead. [Access](/access) explains what a credential can hold.

## Approve an app [#approve-an-app]

An app that signs in opens its approval page in your browser, headed with its name. An app with no browser, such as the CLI, shows a code instead: enter it on the **Connect a device** page at the address the app gives, within ten minutes. Sign in as the owner if the page asks.

**Marfa can't confirm who made an app**, because any program can register with any name. Approve only apps you trust.

1. Read **Full access**, which the page opens on: what the app asked for, in plain words, with a last line for anything that can't be undone.
2. To give less, select **Choose access**, which opens a control for each part:
   * **Already allowed:** what the app held before. Approving never lowers it.
   * **Your data:** **No access**, **Read only** or **Read and edit** for each item type, up to what the app asked. An app that asks for every type, with `*:read` or `*:write`, can be given chosen types instead.
   * **Your profile:** shown only when the app asks for it.
   * **More control over Marfa:** each permission starts off. `instance.maintain`, `schema.write` and `items.purge` are marked because they can't be undone.
3. Select **Approve**, or **Cancel** to decline.

A request with nothing new to grant shows no choice. Choosing access with everything new off **is declining**: the app gets `access_denied` and keeps what it held.

Granting a write or a permission the app doesn't hold needs a sign-in from the last five minutes, so the page asks you to [confirm it's you](/run/sign-in-as-the-owner#confirm-its-you). A program that sends the approval without one gets `403 forbidden` and no code.

## Narrow or disconnect an app [#narrow-or-disconnect-an-app]

Open **Connected apps** from [Home](/run/sign-in-as-the-owner#start-from-home) and choose the app. Its page shows what it can reach and the keys it made.

* **To narrow it**, turn access off under **Access** and select **Save**. Tokens and refresh chains that exceed the remaining access end at once, and the rest keep working. The app asks again if it needs more, and wider access needs a fresh approval.
* **To disconnect it**, select **Disconnect**. Its sign-in ends at once, and the keys it made keep working unless you also select **Also revoke the keys it made**.

Both need a sign-in from the last five minutes. Narrowing leaves the keys the app made as they are, so narrow or revoke those as [Manage keys](/run/manage-keys) shows.

An approval ends when the app goes unused for a year. `grant_inactivity_days` in [Settings](/run/settings#change-settings-while-it-runs) changes that period, and `0` keeps every approval. An app disconnects itself as [Revoke access](/build/authenticate#revoke-access) shows.

The rules behind this page are in the [keys and sign-in](https://github.com/withmarfa/marfa/blob/main/conformance/spec/keys-and-oauth.md) chapter of the contract.