---
title: "Authorized Apps: permissions, scopes and revoking access"
description: "Settings → Authorized Apps lists every Claude and ChatGPT connection, its seven scopes and connected date. Admins see all members."
url: https://help.k3x.ai/en/articles/106-authorized-apps-permissions-scopes-and-revoking-access
collection: "Claude, ChatGPT and MCP"
updated: 2026-10-04
language: en
---

# Authorized Apps: permissions, scopes and revoking access

Settings → Authorized Apps lists every Claude and ChatGPT connection, its seven scopes and connected date. Admins see all members.

**Settings → Authorized Apps** is where K3X shows every Claude and ChatGPT connection in your workspace: who connected, which scopes they granted, when, and a **Revoke** button. Each member connects separately; Owners and Administrators also see other members' connections.

## The seven scopes

When you connect an assistant, K3X asks you to approve scopes. Each one unlocks a group of MCP tools:

-   **Read records**: search and read companies and people, including their activity feeds. Tools like `search_leads`, `get_contact_details`, `get_lead_activity_feed`.
    
-   **Create and edit records**: create, update, assign, link, set custom fields, archive and restore companies and people, one at a time or in bulk.
    
-   **Read deals**: search deals and list pipeline stages.
    
-   **Create and edit deals**: create deals, move stages, update amounts and fields, archive and restore.
    
-   **Read emails calls and meetings**: the assistant can read timeline activity such as emails, calls and meetings on a record. Without it, the assistant sees the record but not the conversation history.
    
-   **Read AI agents**: list agents and read their goals, steps and deliveries.
    
-   **Create and edit AI agents**: create, update, activate, pause and archive agents and manage their webhooks.
    

Grant only what you need. A rep who wants Claude for research can approve the three read scopes and nothing else. An Owner setting up agents from ChatGPT needs the agent scopes too.

## Scopes are a ceiling, your role is the floor

A scope never gives an assistant more than your K3X role allows. A Sales Representative who approves "Create and edit deals" can still only edit the deals they could edit in the app. Roles are set in **Settings → Team** and described in **Settings → Roles & Permissions**.

## Per-member connections

Connections belong to a person, not to the workspace. If three teammates each connect Claude, Authorized Apps shows three connections, each with its own scopes and date. Every action an assistant takes is logged on the record timeline with that member as the actor, so you can always see who asked for a change.

## What admins see

Owners and Administrators get a second section, **Other members' connections**, listing every member's Claude and ChatGPT connections with their scopes. Use it to:

-   Check that a departing teammate's connections were revoked.
    
-   Spot connections with write scopes that a role does not need.
    
-   Confirm who connected which assistant and when.
    

## Revoke a connection

1.  Open **Settings → Authorized Apps**.
    
2.  Find the connection (yours, or a member's if you are an admin).
    
3.  Click **Revoke**.
    

The token stops working immediately. The assistant's next request will fail with a permission error until the person connects again. Revoking does not delete any records or undo anything the assistant already did.

## Change scopes

Scopes are fixed at connection time. To add or remove one, revoke the connection and connect again, approving the new set.

## When a teammate leaves

Removing a member from **Settings → Team** ends their access to the workspace, including through connected assistants. Still, check Authorized Apps afterwards so the list stays clean.

## Related

-   Roles and permissions: Owner, Administrator, Sales Manager, Sales Representative
    
-   K3X for Claude
    
-   K3X for ChatGPT
    
-   Security, privacy and data handling