> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.runtype.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.runtype.com/_mcp/server.

# Connected apps and secret intake

Two parts of Settings handle access that starts outside the dashboard. **Connected apps** lists the apps that you signed in to with your Runtype account, so you can revoke them. The secret intake page is where you enter credentials that a product, a coding agent, or a script asked for, without pasting them into a chat or a terminal.

## Review connected apps

When an app offers sign-in with Runtype, you approve it on an **Authorize** screen. If you belong to more than one organization, select the account in **Authorize in** before you click **Authorize**. Each approval creates a grant for one account, and the grant has its own API key that the app uses to act on your behalf.

To see your grants, open **Settings > Connected apps**. Each row shows the following details:

* **App name and tier**: **First-party**, **Verified**, **Unverified**, or **Internal**. Runtype hasn't verified an **Unverified** app, so authorize one only if you trust its developer.
* **Status**: **Active**, **Inactive** when the app's API key is deactivated, or **Revoked**. Hold the pointer over **Revoked** to see the reason.
* **Account**: **Personal**, or the organization name. A grant in an organization other than your active one has a highlighted organization badge.
* **Scopes**: The first three scopes that the app received. Hold the pointer over **+N more** to see the rest.
* **Authorized** and **Last used**: The dates when you approved the app and when its API key last made a request.

The list includes your own grants in every account. If you're an admin of your active organization, it also includes other members' grants in that organization.

Connecting Claude or another MCP client to the Runtype MCP server doesn't create a grant here. It creates an API key in **Settings > API**. For how to remove that access, see [Managing Runtype with Claude](/user-guide/troubleshooting-faq/managing-runtype-with-claude).

## Revoke an app

Revoking a grant deactivates the app's API key immediately. The app can't call the Runtype API again until you sign in to it and authorize it again.

To revoke an app, follow these steps:

1. Open **Settings > Connected apps**.
2. On the app's row, click the button labeled **Revoke access for** and the app name. A dialog asks you to confirm.
3. Click **Revoke access**. The row leaves the list. The next time you open **Connected apps**, the app appears with the **Revoked** status.

Only an active grant has a revoke button. Admins can revoke any grant in their active organization.

## Enter secrets from a setup link

A setup link opens the secret intake page, which lists the secrets that something needs and lets you enter their values in the browser. Values that you enter there never pass through the tool that sent you. Setup links come from these places:

* **A product**: On the product's page, a banner shows how many secrets need configuration. Click **Show details** to list them, or **Configure** to open the intake page.
* **A coding agent or MCP client**: The `get_secret_intake_manifest` tool on the Runtype MCP server returns a setup link for a person to open.
* **Your own code**: The `POST /v1/secrets/setup-url` endpoint returns a setup link for the secret names that you send. For details, see [Create a setup link with the API](#create-a-setup-link-with-the-api).

To enter secrets from a setup link, follow these steps:

1. Open the link and sign in if the dashboard asks you to.
2. At the top of the page, check the account name after **Saving to**. Secrets save to that account.
3. In each field, paste a value of at least 8 characters. Fields marked **Optional** can stay empty. A field marked **Already configured** has a value. Leave it empty to keep that value, or paste a new one to replace it.
4. Click **Save N secrets and continue**, where N is the number of values that you entered.

Runtype encrypts the values and marks each secret active. If you opened the page from a product and no secrets remain, the dashboard returns you to the product. To leave without saving, click **Cancel** or press `Esc`.

After you save, you manage these secrets like any other on **Settings > Secrets**. You can't view a value again, but you can rotate or delete it. For more information, see [Managing secrets](/user-guide/settings/managing-secrets).

### Create a setup link with the API

To send someone a link for credentials that your integration needs, send a `POST` request to `/v1/secrets/setup-url` with up to 50 secret names. The API key needs the `SECRETS:READ` permission.

**`cURL`**

```bash title="cURL"
curl https://api.runtype.com/v1/secrets/setup-url \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keys": ["STRIPE_API_KEY", "SLACK_BOT_TOKEN"]}'
```

Replace `YOUR_API_KEY` with your Runtype API key.

The output is similar to the following:

```json
{
  "url": "https://use.runtype.com/settings/secrets/configure?account=org_YOUR_ORG_ID&source=secret&keys=STRIPE_API_KEY%2CSLACK_BOT_TOKEN",
  "missing": ["STRIPE_API_KEY", "SLACK_BOT_TOKEN"],
  "revoked": [],
  "alreadyConfigured": []
}
```

The link covers every name in `missing` and `revoked`. If no name needs a value, `url` is `null`. The link carries secret names only, never values.

A secret that exists without a value, with the `needs_configuration` status, is listed in `alreadyConfigured` and isn't in the link. To fill one of those, use **Set value** on **Settings > Secrets**, as described in [Fill a pending secret](/user-guide/settings/managing-secrets#fill-a-pending-secret).

## Next steps

* [Managing secrets](/user-guide/settings/managing-secrets): rotate, delete, and reference secrets.
* [Managing API keys](/user-guide/settings/managing-api-keys): review the API keys in your account.
* [Runtype MCP server](/developer-guides/integrations/runtype-mcp-server): collect secrets from a coding agent without pasting them into chat.
* [FPO templates](/developer-guides/guides/fpo-templates#collect-credentials): declare the credentials that a template asks importers for.
* [Authentication issues](/user-guide/troubleshooting-faq/authentication-issues): fix a failed app authorization.