Skip to navigation
Settings

Connected apps and secret intake

Two parts of Settings handle access that starts outside the dashboard. Connected apps lists the apps that you signed in to with your Runtype account, so you can revoke them. The secret intake page is where you enter credentials that a product, a coding agent, or a script asked for, without pasting them into a chat or a terminal.

Review connected apps

When an app offers sign-in with Runtype, you approve it on an Authorize screen. If you belong to more than one organization, select the account in Authorize in before you click Authorize. Each approval creates a grant for one account, and the grant has its own API key that the app uses to act on your behalf.

To see your grants, open Settings > Connected apps. Each row shows the following details:

  • App name and tier: First-party, Verified, Unverified, or Internal. Runtype hasn’t verified an Unverified app, so authorize one only if you trust its developer.
  • Status: Active, Inactive when the app’s API key is deactivated, or Revoked. Hold the pointer over Revoked to see the reason.
  • Account: Personal, or the organization name. A grant in an organization other than your active one has a highlighted organization badge.
  • Scopes: The first three scopes that the app received. Hold the pointer over +N more to see the rest.
  • Authorized and Last used: The dates when you approved the app and when its API key last made a request.

The list includes your own grants in every account. If you’re an admin of your active organization, it also includes other members’ grants in that organization.

Connecting Claude or another MCP client to the Runtype MCP server doesn’t create a grant here. It creates an API key in Settings > API. For how to remove that access, see Managing Runtype with Claude.

Revoke an app

Revoking a grant deactivates the app’s API key immediately. The app can’t call the Runtype API again until you sign in to it and authorize it again.

To revoke an app, follow these steps:

  1. Open Settings > Connected apps.
  2. On the app’s row, click the button labeled Revoke access for and the app name. A dialog asks you to confirm.
  3. Click Revoke access. The row leaves the list. The next time you open Connected apps, the app appears with the Revoked status.

Only an active grant has a revoke button. Admins can revoke any grant in their active organization.

A setup link opens the secret intake page, which lists the secrets that something needs and lets you enter their values in the browser. Values that you enter there never pass through the tool that sent you. Setup links come from these places:

  • A product: On the product’s page, a banner shows how many secrets need configuration. Click Show details to list them, or Configure to open the intake page.
  • A coding agent or MCP client: The get_secret_intake_manifest tool on the Runtype MCP server returns a setup link for a person to open.
  • Your own code: The POST /v1/secrets/setup-url endpoint returns a setup link for the secret names that you send. For details, see Create a setup link with the API.

To enter secrets from a setup link, follow these steps:

  1. Open the link and sign in if the dashboard asks you to.
  2. At the top of the page, check the account name after Saving to. Secrets save to that account.
  3. In each field, paste a value of at least 8 characters. Fields marked Optional can stay empty. A field marked Already configured has a value. Leave it empty to keep that value, or paste a new one to replace it.
  4. Click Save N secrets and continue, where N is the number of values that you entered.

Runtype encrypts the values and marks each secret active. If you opened the page from a product and no secrets remain, the dashboard returns you to the product. To leave without saving, click Cancel or press Esc.

After you save, you manage these secrets like any other on Settings > Secrets. You can’t view a value again, but you can rotate or delete it. For more information, see Managing secrets.

To send someone a link for credentials that your integration needs, send a POST request to /v1/secrets/setup-url with up to 50 secret names. The API key needs the SECRETS:READ permission.

cURL
curl https://api.runtype.com/v1/secrets/setup-url \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keys": ["STRIPE_API_KEY", "SLACK_BOT_TOKEN"]}'

Replace YOUR_API_KEY with your Runtype API key.

The output is similar to the following:

{
  "url": "https://use.runtype.com/settings/secrets/configure?account=org_YOUR_ORG_ID&source=secret&keys=STRIPE_API_KEY%2CSLACK_BOT_TOKEN",
  "missing": ["STRIPE_API_KEY", "SLACK_BOT_TOKEN"],
  "revoked": [],
  "alreadyConfigured": []
}

The link covers every name in missing and revoked. If no name needs a value, url is null. The link carries secret names only, never values.

A secret that exists without a value, with the needs_configuration status, is listed in alreadyConfigured and isn’t in the link. To fill one of those, use Set value on Settings > Secrets, as described in Fill a pending secret.

Next steps