Connected apps and OAuth permissions in EGREED ID
Manage connected applications, understand application permissions and OAuth scopes, revoke access, and use third-party authentication with Sign in with EGREED.
On this page
Connected applications
Connected apps are EGREED or third-party applications you authorised to access parts of your account. Open Security → Connected apps to see each app, its scopes, when access was granted and when it was last used.
Application permissions
Permissions are explicit and granular. An app that only needs your name and email cannot read your Drive files. Any request for new scopes triggers a fresh consent screen.
Revoking access
Select an app and choose Revoke access. All of its access and refresh tokens are invalidated immediately and it must ask for consent again.
Third-party authentication
You can link Google or Microsoft accounts as additional sign-in methods, and use Sign in with EGREED on partner sites. Linking never grants a provider access to your EGREED data.
OAuth permissions and scopes
openid— issue an ID tokenprofile— name, photo, localeemail— verified email addressoffline_access— refresh tokens for long-lived accessdrive:read/drive:write— EGREED Drive filesmail:send— send mail on your behalfdeploy:manage— manage EGREED Deploy projects
For developers
- Register your application in the EGREED developer console.
- Store the client ID and secret securely; never ship the secret to a browser.
- Configure exact redirect URIs — wildcards are rejected.
- Use the authorization-code flow with PKCE for web and mobile clients.
- Validate ID tokens against the JWKS endpoint and check
iss,audandexp. - Rotate refresh tokens and handle revocation responses gracefully.
See Authentication and APIs for full references.
Best practices
- Review connected apps every quarter
- Grant the narrowest scope that works
- Revoke anything unused for 90 days
- Prefer short-lived tokens with rotation over long-lived API keys
More EGREED ID documentation
- EGREED ID overview
- EGREED ID features
- Create an EGREED ID
- Sign in to EGREED ID
- EGREED ID account recovery
- EGREED ID Security Center
Related platforms: Authentication and SSO, Security, Account, EGREED AI, EGREED Cloud, EGREED Deploy.
Official links: id.egreedtech.org · egreedtech.org · EGREED FAQ hub · Contact support.
Frequently asked questions
How do I revoke an app's access?
Open Connected apps, select the application and choose Revoke access. Its tokens stop working immediately.
What are OAuth scopes?
Granular permissions such as profile:read, email:read or drive:write that limit exactly what a connected app can do.
Does EGREED ID support OpenID Connect?
Yes. EGREED ID is a certified-style OpenID Connect provider exposing discovery, authorization, token, userinfo and JWKS endpoints.
How do developers add Sign in with EGREED?
Register an app in the developer console, obtain a client ID and secret, configure redirect URIs, and use the standard authorization-code flow with PKCE.
What are API tokens?
Long-lived credentials for server-to-server access, scoped, revocable and rotatable from Developer → Tokens.
Does EGREED ID support SAML for enterprises?
Yes. Enterprise organizations can federate with SAML 2.0 identity providers such as Microsoft Entra ID, Okta and Google Workspace.
What is an organization account?
A workspace identity that groups members, enforces security policies, manages roles and centralises billing across EGREED products.