OAuth apps with limited access
Connect another application to your account, see exactly which notebooks it may read, and switch it off in one click when you no longer need it.
Sofia wrote a small script that collects the week’s new notes from her team’s research notebook and sends a digest on Friday. To run it she had to give the script her personal API token. That token can read every notebook she has, edit them and delete them. The script needs to read one.
The useful integrations are small and specific. The access we give them today is large and general. That is a bad trade, and it gets worse the moment the script is shared with a colleague.
Access the size of the task
Sofia’s script will ask for exactly what it needs: read access to one notebook. Kartoteq will show her that request in plain words, she will approve it, and the script will get a token that cannot do anything else. In her settings she will see every connected app, what each was given and when it was last used, and a single button to cut it off.
This is ahead, after webhooks, because both need the same permission model and we want to build it once. It is about outside apps getting into Kartoteq, not about signing in to Kartoteq with another account, and before release we have to check that a revoked app loses access at once, including anything it cached.
Planned · Integrations
What is in scope
This is ahead, after webhooks, because both need the same permission model and we want to build it once. It is about a third-party app asking for access to your Kartoteq, not about signing in to Kartoteq with an outside account: the app will request specific rights, say reading one notebook, you will approve or refuse, and a list of connected apps will show what each one was given. Before release we have to check that a revoked app really loses access immediately, including anything it had cached.
Where it stands
This direction is in the plan but not in development yet. We will write here when work starts and when there is something to try. Until then there is no date, and we would rather say so than guess.
If this direction matters to you, tell us about the task behind it. A concrete situation changes what we build more than a vote for a feature does.
Tell us about your task