Connect an app

Some apps ask to read keys from Penv Cloud, for example to call a service with your API key. You approve each one on a page of ours, and choose what it can see. Developers: the flow and how to register an app.

What the app sees

• Only the keys you tick. Keys you leave unticked, and every other key in the environment, are not sent.
• One environment. The app cannot read another environment or project.
• Read only. The app cannot add, change or delete a key.
• Never a write-only environment, and never an environment that requires approval for changes. Those are shown as unavailable on the approval page (write-only environments, change requests).

You can only share what you can already reveal. If you lack permission to reveal values in an environment, you cannot connect an app to it.

Connect

1. Start from the app. It opens the approval page in your browser; sign in if asked.
2. Check the app name and its website, shown under the name. Check the address it will send you back to as well.

If the page says Unverified app, Penv has not reviewed it. Only people in the organization that built it can connect it. Connect it only if you know who made it. A verified app shows its icon. An unverified one shows a letter. 3. Pick the organization, project and environment. 4. Untick any key you do not want to share. A key the environment does not have shows Not in this environment; add it there first if you want to share it. 5. Choose Allow. We may ask you to confirm your identity first (step-up). Cancel tells the app you said no.

Report an app

If an app looks wrong, choose Report this app on the approval page and say why in up to 500 characters. We review reports. If we suspend an app, every connection to it ends at once.

Change the keys

Open Settings > Security, the CLI sessions tab, and find the Connected apps list. The environment's page has the same list, showing only your own apps for that environment. Choose Change keys on the app, tick or untick keys, and choose Save keys. The app gets the new set the next time it asks.

You can tick any key the app asked for when you connected it, including one you unticked then. A key it never asked for cannot be added; the app has to send you through the approval page again. A key the app already has that the environment no longer holds stays shared, so the app can read it once it is added back.

If you delete a key from the environment, the app simply stops receiving it.

Disconnect

Choose Disconnect on the app, in either place above, and confirm. We may ask you to confirm your identity first. The app loses access at once, including any short credential it already holds. The app can also disconnect itself.

To connect again, the app has to send you through the approval page.

Expiry

A connection that no app has used for 90 days expires, and the app needs your approval again. The list shows when each connection was last used.

What we record

Connecting, changing keys, disconnecting and each time the app reads are in the audit log. Entries name the keys, never their values.