> ## Documentation Index
> Fetch the complete documentation index at: https://learn.social.plus/llms.txt
> Use this file to discover all available pages before exploring further.

# Manage access

> Control who can ask about your first-party data — connect codes, connector credentials, and connected apps in the Console.

Everything about Agentry access lives in **Console → Settings → Agentry**, available to super admins. The page has two sections matching the two ways apps connect:

* **Via AI app** — connect codes and the connected-apps list, for directory-installed apps like ChatGPT and Claude.
* **Via MCP** — connector credentials and connected clients, for MCP tools like Claude Code and Cursor.

<Info>
  If the page says Agentry isn't enabled, contact support to turn it on.
</Info>

## How access works

Agentry has **read-only** access to your network's data: the only thing any connection can do is ask questions of your first-party engagement data. Who gets to ask is entirely in your hands — every connection exists because a super admin issued a connect code or a credential, every connection is listed, and any of them can be removed at any time without affecting the others.

## Via AI app

### Connect codes

A connect code links one application sign-in to your network's data.

<Steps>
  <Step title="Generate">
    Choose **Generate connect code**. Enter a **label** — who or what the code is for (for example, "Alice — marketing"). The label is required: it is copied onto the resulting connection and is the only thing that tells connections apart, because every user of the same AI app shares one app identity.
  </Step>

  <Step title="Choose what it grants">
    Pick the scopes the code grants (for example, *Read your engagement data*). A code must grant at least one thing.
  </Step>

  <Step title="Hand it over">
    The code is shown **once** — copy it immediately. Codes are single-use and expire (the exact expiry is shown when you generate one). If a code is lost or goes unused, generate another.
  </Step>
</Steps>

### Connected apps

The **Connected apps** table lists every application currently linked to your data — its label, the application, its verified origin, and when it connected.

* **Remove** signs that application out; it stops being able to answer questions within about 15 minutes. Every other connected app keeps working.
* A removed app can reconnect later with a new connect code.

## Via MCP

### Connector credentials

A connector credential is a Client ID + Client Secret an MCP client uses to sign in. When creating one, pick the client type that matches how the client handles OAuth:

| Client type                | For                                    | Redirect behavior                                                                                         |
| -------------------------- | -------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| **Claude (web connector)** | Claude.ai custom connectors            | Claude's hosted callback                                                                                  |
| **Native / CLI**           | Claude Code, Cursor, other local tools | Loopback redirect (ephemeral local port)                                                                  |
| **Custom redirect URL**    | Apps running their own OAuth callback  | Your URL — https, or http only for `127.0.0.1`, `localhost`, `[::1]`; no fragment or embedded credentials |

The client secret is shown **once** at creation — copy it then. Treat the pair like an API key: whoever holds it can connect as that credential.

* **Revoke credential** stops every connection using it, permanently. Use it to rotate a leaked secret or off-board a tool.

### Connected clients

The **Connected clients** table shows sessions currently signed in with your credentials. Removing one ends that session — within about 15 minutes — **without revoking the credential**, so anyone else using the same credential is unaffected, and the client can sign in again.

## Choosing between codes and credentials

|          | Connect code                                           | Connector credential                                                       |
| -------- | ------------------------------------------------------ | -------------------------------------------------------------------------- |
| Best for | Directory apps (ChatGPT, Claude) and one-person grants | MCP dev tools, AI agents in agentic workflows, and long-lived integrations |
| Sharing  | Never — single-use, one person, labeled                | The pair can serve a tool's users, at the cost of coarser control          |
| Removal  | Per connection, others unaffected                      | Per session (keep credential) or per credential (cut everything on it)     |

## Security notes

* Agentry connections can only **read your first-party engagement data** — there is no scope that writes, moderates, or administers anything.
* Access is network-scoped end to end: a connection to your network cannot see any other network's data.
* Removal takes effect within about 15 minutes of the change.