Permissions and connected apps
When an AI app connects to Chartnaut, you approve it once on a Chartnaut page, and it can then act as you within the permissions on that page. This page covers what those permissions allow, how long a connection lasts, and how to end one.
The consent page
Connecting Claude, ChatGPT, Cursor or another app sends your browser to Chartnaut. If you are not signed in, you sign in first on Chartnaut's own login page, which then returns you to this one. The app never sees your password. The page then shows:
The app's name, as the app registered it, and the address you will return to. Check that address: it is where the app receives access to your account.
What the app will be able to do, in plain words.
Allow and Cancel.
Allow grants exactly the permissions listed and sends you back to the app. Cancel sends you back with nothing granted. A request lasts 10 minutes and can be answered once; after that the page says This request has expired or This request was already answered, and you start again from the app.
The app chooses which permissions to ask for, and you approve them as a set. An app that asks for none gets all three listed. To give an app less, use an API key with fewer scopes instead of the browser sign-in.
Permissions
On the consent page | Scope | What the app can do |
|---|---|---|
Read your scripts, runs and the docs |
| Read your scripts and their source, versions, runs and results, a definition's events, instruments, the scripting reference, the library and your usage. Check a script without saving it |
Create and save scripts |
| Create scripts, save new versions, and change a script's name and description |
Run scripts on Chartnaut's servers |
| Start runs and run a definition over history |
These are the same scopes an API key carries. They narrow what the app can do; none of them adds anything your account cannot already do. The MCP tools reference lists the scope each tool needs.
Some tools need two. Creating a script with save_script first checks that the slug is free, which needs scripts:read. run_script and run_definition_over_history start work with runs:write and then wait for it with scripts:read; without it they return as soon as the work starts, and the app cannot read the results.
Connected apps
Every app you allow is listed on the Developers page, in the menu under your name, under Connected apps. Each row shows the app's name, its permissions, when you connected it and when it was last used. Last used is updated at most once a minute, and reads Never used until the app's first call.
Apps connected with an API key do not appear here. They use the key, which is listed under API keys.
You have one connection per app registration. Connecting the same app again replaces its permissions on the existing row, and the new set applies at once, even to tokens the app already holds. An app that registers afresh, such as a new install of Cursor, shows as a row of its own.
Disconnect an app
Open Developers in the menu under your name.
Under Connected apps, click Disconnect on the app.
Click Disconnect in the confirm dialog.
The app loses access straight away: its next call gets 401 unauthorized, and it cannot sign itself back in without you clicking Allow again. Removing Chartnaut inside the app, such as deleting the connector in Claude, also ends the connection if the app tells Chartnaut, but only Disconnect is certain.
Disconnecting works on every plan, so you can clear out connections after a move to Free.
How long a connection lasts
Lasts | What happens then | |
|---|---|---|
Access token | 1 hour | The app swaps its refresh token for a new pair, without asking you |
Refresh token | 30 days, restarted at every swap | Unused for 30 days, the connection lapses and the app asks you to connect again |
Connection | Until you disconnect it, or it lapses | A lapsed connection stays in the list until you disconnect it |
The app holds these tokens, never your password. Each refresh token works once. An app that sends the same one twice within 30 seconds, such as two windows refreshing together, gets a fresh pair both times. If one comes back later than that, a copy has leaked, so Chartnaut ends the whole connection and the app has to be approved again. Security and privacy explains why.
Plans and connected apps
Connecting needs Starter or above. On Free, Allow answers API access is included on Starter and above with a link to upgrade.
After a move to Free, connected apps stay in the list, but every call they make is refused with plan_limit. They work again within a minute of upgrading, without connecting again, as long as the connection has not lapsed.
A connected app shares your plan's API limits with the CLI and your API keys. Past requests a minute, its tool calls are refused with rate_limited until the minute rolls on. Limits and cost lists what each tool uses.