Connected apps
The apps and tools signed in to your organization with a devguard account, and how organization admins disconnect them.
Overview
This page lists every app and tool that was connected to your organization: an AI client connected over MCP, or a terminal where someone ran devguard login. Each entry names the app, what it may do (read your organization's data, or also upload and change evidence for the CLI), who granted it, when it was granted and when it last called devguard.
Only organization owners and admins see this page. Members do not have the tab, and opening the address shows a note that only admins can manage connected apps.
A connected app is one person's grant: it acts for the person who connected it, in exactly one organization, with only the permissions it asked for on the consent screen, and it stops working when that person is deactivated or removed from the organization. An organization token is owned by the organization instead, limited to the access chosen when it was created, and keeps working after its creator leaves. Prefer connecting apps wherever the app can open a browser. Tokens are for the places that cannot: CI pipelines, scheduled jobs, servers.
How access works
A connected app never holds a permanent secret. It holds a short-lived access token it refreshes on its own, and that refresh stops the moment an admin disconnects the app here, the moment the person who granted it is deactivated in or removed from this organization, or after seven days without use. After a disconnect or a deactivation, reconnecting goes through sign-in and consent again; after the seven days the app simply signs in again.
Disconnecting
Disconnect revokes that person's grant immediately, together with the access tokens the app holds for them in this organization. Other people's grants to the same app are listed as their own entries and are disconnected separately. There is nothing to rotate: the app asks its user to sign in the next time it connects.
The devguard CLI
On a machine with a browser the CLI needs no token: devguard login opens one, you pick the organization that machine may act in, and the login then appears in this list. The setup in CLI covers that path and the token-based one for CI.
How is this guide?