Connected apps
How applications act for members, the difference between disconnecting your own connection and the whole organization's, and what disconnecting does.
A connected app is an application that a member has authorized to act for them, such as the Nuvelics command-line tool or an AI assistant connected over MCP. This page explains what a connection is and how disconnecting works. The screens are in Connected apps for the organization and in User Settings for your own.
What a connection holds
A connection is the standing permission a member gave an application, plus the sign-in credentials the application received because of it. What the application can do is your role's permissions, limited to the scopes you approved, and it is checked against your current role on every request. If you are demoted or removed, the application's access narrows on its next request. The roles behind this are in Roles and permissions.
A connection is made when a member approves an application, on the screens described in Activate a device sign-in and Authorize an application.
Your own connections and the organization's
There are two levels, with different owners.
| Your own connections | The organization's connections | |
|---|---|---|
| Shows | The applications you connected in this organization | Every application any member connected, and who |
| Who can use it | Every member | Owners (org:update) |
| Disconnecting ends | Your connection only | Every member's connection to that application |
Disconnecting your own connection is not an administrative act: it removes only your authorization and the credentials issued to you, so other members who connected the same application keep their own access. Disconnecting for the whole organization is for when an application should lose access entirely, such as after a leak or when an assistant is no longer wanted. Each member must then reconnect and re-authorize it before it works again.
In both cases the credentials stop working at once; the application does not keep access until its tokens expire. Whether self-registered applications can hold a token at all is a separate setting, described in MCP.
Connected apps and API keys
They are different. A connection acts for a member and follows their role. A service key acts for the organization with a fixed set of permissions, and it does not appear among connected apps. Revoke a key on its own: see API keys. A service key has no connection of its own, so it cannot use the "your own connections" operations.
Where to do it
| Task | Web app | Command line | API |
|---|---|---|---|
| List your own connections | User Settings, Connected apps | nuvelics oauth-connections list --mine | GET /api/tenant/v1/oauth-connections/mine |
| Disconnect your own | Disconnect | nuvelics oauth-connections revoke [id] --mine --yes | DELETE /api/tenant/v1/oauth-connections/mine/{id} |
| List the organization's | Settings, Connected apps | nuvelics oauth-connections list | GET /api/tenant/v1/oauth-connections |
| Disconnect for everyone | Disconnect for the whole organization | nuvelics oauth-connections revoke [id] --yes | DELETE /api/tenant/v1/oauth-connections/{id} |
The command-line reference is nuvelics oauth-connections,
and the API reference is Connected apps.