Connected apps
The apps and tools you signed in to with your devguard account, and how to disconnect them.
Overview
This page lists the apps and tools you signed in to with your devguard account: an AI client connected over MCP, or a terminal where you ran devguard login. Each entry names the app, the one organization you granted it, what it may do (read your organization's data, or also upload and change evidence for the CLI), when you connected it and when it last called devguard.
A connected app is the opposite of an API token. A token can do everything you can, in every organization you belong to; a connected app is granted exactly one organization and only the permissions it asked for on the consent screen. Prefer connecting apps over creating tokens wherever the app can open a browser. A token is for the places that cannot: CI pipelines, scheduled jobs, servers.
How access works
A connected app never holds a permanent secret. It holds a short-lived access token it refreshes on its own, and that refresh stops the moment you disconnect it here, the moment you are deactivated in that organization, or after seven days without use. After a disconnect or a deactivation, reconnecting goes through sign-in and consent again; after the seven days the app simply signs in again.
Disconnecting
Disconnect revokes the app immediately. There is nothing to rotate: the app simply asks you to sign in the next time it connects.
The devguard CLI
On a machine with a browser the CLI needs no token: devguard login opens one, you pick the organization that machine may act in, and the login then appears in this list. The setup in CLI covers that path and the token-based one for CI.
How is this guide?