Skip to navigation
API referenceOAuth

Review applications in Settings

Existing browser session; unauthenticated users are redirected to login. Lists all of this user’s current OAuth authorizations, with approved capabilities/scopes, authorization expiry and CSRF-protected disconnect forms in the normal Settings shell. MCP account access guidance is secondary and does not restrict management of other applications. No token hashes, secrets or last-used telemetry.

Response headers:

  • Cache-Control (200, 303): no-store.
  • Referrer-Policy: same-origin for the documented 200 page; no-referrer for redirects.
  • Location (303): login when unauthenticated.

Response headers

Cache-Control"no-store"Optional
Referrer-Policy"same-origin"Optional

Native consent form Origin proof; never sends referrers cross-origin.

Response

Escaped server-rendered consent/connected-app page. No token is issued by GET.