Connected Applications 1.31+
Connected applications let a third-party app — an AI assistant talking to Runner over MCP, or any other OAuth-capable client — access your account without you sharing your password or copying a token by hand. You approve each connection once; Runner keeps the app signed in and lets you review or revoke access at any time.
Like personal access tokens, even a connection with full access can never change your account or security settings.
Connecting an application
A client that supports OAuth initiates the connection itself — for example, by opening the URL an MCP client gives you, or by clicking a "Connect" button in the client's own settings. Runner opens a consent screen showing the application's name and the access it is requesting.
If you are not already signed in, Runner asks for your email and password first. Click Allow to approve the connection, or close the window to deny it. Approving redirects you back to the application, which can now act on your behalf.
Your connected applications
Open Integrations from the left sidebar (or search for it) and find the Connected Applications card. It lists every application you have approved, alongside your personal access tokens.
Click an application to open its detail view:
Application — the name the application identified itself with when it connected.
Redirect URIs — the URLs the application may be redirected back to after you approve access. An unfamiliar entry here can indicate a hijacked or misconfigured client.
Scope — Full Access (read and write) or Read Only, as requested by the application when it connected.
Created — when you first approved the connection.
Expires — when the application's current access token expires. It renews automatically in the background as long as the connection keeps being used.
Refresh Token Expires — once past this date, the application must ask you to reconnect before it can continue acting on your behalf. This is the date to watch for a connection you expect to stay active unattended, such as an AI assistant or an automated integration.
Last Used and Last Used From — when the connection was last used, and from which IP address.
Request Count — the total number of requests made through this connection.
Revoking access
Click the delete button on an application row, either in the list or in its detail view. Revocation takes effect immediately and disconnects the application — it will need to go through the consent screen again to reconnect. Revoked connections cannot be restored.
Email notifications
If SMTP is configured in Settings, Runner sends you an email whenever an application connects or is disconnected. These emails serve as security notices — if you receive one for a connection you did not initiate, revoke it immediately and contact your Admin.