> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attensira.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connected applications

> See which AI clients have OAuth access to your workspace, what they can do, and how to revoke one.

When you connect an AI client to the [MCP server](/mcp/overview) with OAuth, the approval you give creates a **connection**: one application, one workspace, one set of scopes. Settings → Connections at [app.attensira.com/settings/connections](https://app.attensira.com/settings/connections) lists them and is where you take one away.

Static `atn_live_` keys are not connections and do not appear here — they live under Settings → Developer. See [API keys](/account/api-keys).

## GitHub is not on this list

[GitHub](/agent/github) is a first-party **GitHub App** that you install into your organisation or account. It is not an OAuth connection and it is not brokered through a third-party connector, so it does not appear on this page and cannot be revoked from it.

Manage it from the project's GitHub settings, or from GitHub's own installation page. Revoking an OAuth connection here has no effect on the App, and uninstalling the App has no effect on anything listed here.

## What the list shows

| Column      | What it tells you                                                                                                                                  |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Application | The client's name. A client Attensira recognises — Claude, Claude Code, Cursor, VS Code — shows a verified marker; anything else registered itself |
| Workspace   | Which workspace this connection reaches. A connection never spans two                                                                              |
| Access      | `Read` or `Read and write`, from the scopes you approved                                                                                           |
| Connected   | When you approved it                                                                                                                               |
| Last used   | The most recent token issued or refreshed for this connection                                                                                      |

<Warning>
  An unverified application chose its own display name. Nothing stops someone registering a client called "Attensira Sync" and hoping the name is enough. If you do not recognise an entry — especially one with write access — revoke it and reconnect from the client you actually use.
</Warning>

## Revoking a connection

Press **Revoke** on the row. The next time that client tries to refresh, it fails and prompts you to sign in again. Nothing else in the workspace changes: prompts stay tracked, automations keep running on their schedules, and data collected through the connection stays.

<Note>
  Revocation is not instantaneous everywhere. It stops refreshes immediately, but an access token the client is already holding stays valid until it expires, which is at most 60 minutes. If a credential has actually leaked, revoke and then assume up to an hour of remaining access rather than none.
</Note>

Revoke when a laptop is lost or decommissioned, when someone leaves, when you were testing a client you no longer use, or whenever you cannot say what an entry is. Reconnecting takes one browser prompt, so revoking first and asking later is the cheap direction.

## Connected to the wrong workspace

You pick the workspace once, at the consent screen, and a connection cannot be moved afterwards — the same rule that applies to keys. If a client is reading the wrong workspace, revoke the connection here, then reconnect from the client and choose the right one when the browser asks.

If you work in several workspaces at once, connect the client once per workspace under separate server entries rather than switching one back and forth.

## Reconnecting

Connections do not last forever on their own. A client that has not been used for 60 days, or any connection older than 180 days, stops refreshing and asks you to sign in again. That is normal and takes one browser prompt — nothing is lost and no configuration changes.

If a client asks for consent much more often than that, it is not storing the refresh token it was given. See [MCP troubleshooting](/mcp/troubleshooting).

Next: [OAuth reference](/mcp/oauth) for what happens underneath, or [Connect a client](/mcp/connect) to add another one.