Claude Connectors and OAuth: Access, Consent, and Revocation
Claude connectors use OAuth to give Claude access to external services. Understanding how consent works, what scopes mean, and how to revoke access helps you stay in control of what Claude can do.
Updated 6 min read
Claude connectors use OAuth to let Claude access external services on your behalf. You sign in to the connected service in a browser, review what access is being requested, and click Approve. That authorization is specific to Claude and separate from your regular session in that service. Understanding what the consent screen tells you, what each scope means in practice, and how to revoke access when you no longer want it keeps you in control of what Claude can and cannot do. Tools like fenbs use the same OAuth model — when you connect Claude to fenbs, you authorize it under your own identity, with roles and permissions controlling exactly what it can read or change.
OAuth is a standard authorization protocol. It lets you grant a third party — in this case Claude — permission to access a service you use, without giving it your password. The service issues Claude a token that represents the access you approved, and Claude uses that token for subsequent requests.
What the consent screen is telling you
When you connect a service to Claude, the service shows a consent screen. That screen lists the permissions — called scopes — that Claude is requesting. Each scope describes a category of access. "Read your calendar events" is a scope. "Create and delete calendar events" is a different scope with more risk.
Read the scope list before clicking Approve. The scopes shown represent what Claude will be able to do for as long as the authorization is active, not just during the current session. If the scope list includes access you did not expect — write access to a resource you only needed Claude to read — you can decline and check whether a narrower connector option is available.
The consent screen also shows the name of the application requesting access. For official Claude connectors, this will be Anthropic or the connector's registered name. If the name is unfamiliar, do not approve until you have confirmed what you are authorizing.
What scopes mean in practice
Scopes are defined by the service you are connecting to, not by Claude. The same scope name can mean different things on different platforms. "Read" on one service might mean read access to all data in your account; on another it might be limited to a specific resource type.
Common scope categories and what to watch for:
- Read scopes: Claude can see the data but cannot change it. Lower risk, but check whether it includes sensitive categories like private messages or financial records.
- Write scopes: Claude can create or modify data. Higher risk — understand exactly which resources it can write to before approving.
- Delete scopes: Claude can remove data. These should only be approved when the workflow genuinely requires deletion.
- Admin scopes: Claude can manage settings, users, or permissions. Rarely appropriate for an AI connector; decline unless you have a specific reason.
How access is stored and used
After you approve, the service issues an access token. Claude holds this token and uses it to make requests to the service on your behalf. Access tokens typically expire after a set period — hours or days — and may be refreshed automatically using a refresh token, which has a longer life.
The token represents the access you approved at the moment of consent. If the service later adds new scopes or changes what a scope covers, the existing token reflects the permissions at the time it was issued. Re-authorizing updates the token to current scope definitions.
Access tokens are stored by Claude for the active connector session. They are not visible to you in the chat. If you want to change what Claude can access, use the revocation steps below and re-authorize with the updated scope selection.
Revoking access
Revocation ends Claude's authorization to access the connected service. There are two places to revoke:
- In Claude's connector settings: remove the connector from your account. This tells Claude to stop using the token.
- In the connected service: find the section for connected apps, authorized apps, or security, and revoke Claude's access there. This invalidates the token itself.
Revoking in one place is not always enough. If you revoke in Claude but not in the service, the token remains valid at the service level and could be used if it were somehow reused. Revoking in both places is the complete cleanup.
fenbs connects under your identity with explicit approval
When you connect Claude to fenbs, you authorize it under your own account using OAuth. Claude acts within your role and the access you approved — it cannot do anything you could not do yourself. You can see the connection in Settings, check what it has done in History, and revoke it at any time. Roles and permissions are set by people; assistants cannot change them. This is what approved access under a clear identity looks like in practice.
Create a free accountFree for one person · No credit card · Works with Claude, ChatGPT, Cursor and more
When a connector asks for more than it needs
If a connector requests broad scopes — all files, admin access, access to services not relevant to the stated purpose — that is a reason to pause. A well-designed connector requests the minimum access it needs. A scope list that looks broader than the feature warrants is worth questioning before you approve.
You can always decline the authorization and contact the connector developer to ask why a scope is included. For connectors from established services with official support, the scope list is usually intentional and documented. For connectors from unknown sources, treat a broad scope list as a reason to verify the source before approving.
Recording which connectors you approved and why
In a team environment, keeping a record of which connectors were approved, what scopes they were given, and who authorized them helps with security reviews and access audits. An AI-assisted workflow where nobody remembers which access was granted is harder to review and harder to clean up.
Recording connector authorizations as decisions — scope approved, service, authorizing person, date — means the record is available when it needs to be reviewed. If the scope needs to change, the new decision supersedes the old one and the history is preserved.
Add each connector authorization as a Decisions and rules entry: which service, which scopes were approved, who authorized it, and when. Link to the connector settings page so reviewers can find it easily. When access is revoked or updated, record the new decision so the full lifecycle of the authorization is clear.
How to do this with fenbs
- Create a free account and add a project for connector management.
- For each connector you authorize, record the service, the scopes approved, and the date as a Decisions and rules entry.
- Add a standing rule for any scope category that should never be approved without explicit review — admin scopes, delete scopes, access to sensitive data.
- Connect Claude via Integrations using the OAuth flow — you will see exactly what scopes are being requested before approving.
- When a connector is revoked, record that in the same Decisions and rules entry so the history shows the full lifecycle of the authorization.
For a plain-language overview of what Claude connectors do, see Claude Connectors Explained. For how connector setup differs in Claude Code, see Claude Connectors in Claude Code. More connector guides are in the connect-ai topic.