Help center
Take 10 minutes.
Get hours back every week.
Short walkthroughs that turn the platform into your operations team: automated pipelines, instant follow-ups, AI-handled admin. One video, one less thing to do manually.
Integrations
How to Edit OAuth Client Scopes
Customise what a connected integration like Claude.com is allowed to do. Set per-scope tiers, hide an integration's admin powers behind approval, and revoke individual user tokens.
# How to Edit OAuth Client Scopes
OAuth clients let users connect external integrations (like Claude.com) to your TrustPager workspace. When a user authorises a connection, they're trusting that integration with a slice of their own permissions. **Scopes** control which slice — separately for each integration.
This article shows how to customise an OAuth client's scopes after it's been registered.
## Where to find it
1. Open
2. Scroll to the **OAuth Clients** section
3. Click **Edit** on any client (e.g. "Claude Connection", "Simon Personal")
The Edit OAuth Client modal opens with two tabs.
## Tab 1 — Scopes
The scope picker shows every TrustPager resource (Contacts, Email, Tasks, Voice Agents, etc.) with a slider for the access tier.
### Tier vocabulary
For most resources:
- **Read** — fetch records only, no changes
- **Write with Approval** — edits queue for human review at
- **Write Automatically** — edits go through immediately
- **Delete with Approval** — deletions queue for review
- **Delete Automatically** — deletions go through immediately
For communication resources (Email, SMS, Calls):
- **Read** — see message history
- **Send with Approval** — outbound messages queue for review
- **Send Automatically** — outbound messages go out immediately
### Default policy
A newly-registered OAuth client (e.g. Claude.com via Add Custom Connector) gets a sensible default:
- Most workspace resources: **Delete with Approval** tier (read + write auto, delete queues)
- Communication: **Send with Approval** (read auto, sends queue)
- AI / triggers / call initiation: auto-execute
- Admin-tier resources (Billing, Integrations, Phone, Users, Websites, Email Config, Permissions): **Read only**
This means a fresh Claude.com connection can read everything, write CRM data, but can't send emails or delete records without your approval.
### Common edits
**Trust an integration with auto-send.** If an integration is genuinely trusted (e.g. an internal automation you wrote), bump Email from `Send with Approval` to `Send Automatically` for that client. Existing tokens for the client are re-resolved instantly when you save — no re-auth needed.
**Lock down an integration.** Drop a resource to `Read` only. Saves a queue from filling up with edits you'll always reject.
**Block a resource entirely.** Set the slider to `No Access`. The integration will receive a permission-denied error if it tries to call that endpoint.
### How scopes interact with user permissions
The scopes you set here are a **ceiling** for what the integration can request. The actual capability of any individual token is the intersection of:
1. The OAuth client's scopes (this modal)
2. The user's role permissions (set at )
If you grant the OAuth client `Email Send Automatically` but the connecting user is a Read-Only Viewer, that user's token will still only have Read access. The narrower side wins.
## Tab 2 — Active Tokens
Lists every token that's been issued for this OAuth client. Each row shows:
- The user who authorised the connection
- Their company role at the time
- The token prefix and suffix (for identification)
- When the token was last used
- Total request count
### Revoking a token
Click **Revoke** on any active row. The token is immediately invalidated — every API call from it fails with a 401. The user can re-authorise from Claude.com (or wherever the integration lives) to get a fresh token.
Revoking one user's token does NOT affect other users on the same OAuth client. Use this when:
- A team member leaves and you want to cut off their integration access immediately
- A token is compromised
- A user reports unexpected behaviour from their connection
## When you save
1. The new scopes are written to the OAuth client
2. Every active token for this client is re-resolved on the spot — the new scope ceiling takes effect immediately
3. A toast confirms how many tokens were updated
No re-auth flow needed. No waiting period. Edits are live.
## OAuth clients vs API keys
Both grant programmatic access to TrustPager. The difference:
| | API Keys | OAuth Clients |
|---|---|---|
| Created by | An admin via the portal | An integration platform (e.g. Claude.com) via OAuth |
| Identifies | The key itself | The integration AND the user who connected it |
| Permission ceiling | The scopes set on the key | The OAuth client's scopes ∩ the connecting user's role |
| Use case | Server-to-server, internal automation, cron jobs | User-attended third-party integrations like Claude.com, Zapier, etc. |
For the API key flow, see .
## Related
- API keys:
- User permissions and roles:
- Approval queue:
The last piece
Two ways to
meet FinalPiece.
Talk to Evie right now, or book a real human for a deeper walkthrough. Whichever feels right.
01 · Talk to Evie
Pick up the phone.
Hear her in 10 seconds.
VOICEMeet Evie
- RealHer voice passes for human.
- SmartKnows your prices, hours, and trade.
- PatientPolite, attentive, never has a bad day.
or
02 · Book a demo
Pencil us in.
60 minutes with a real human · Google Meet · Free.
June 2026
S
M
T
W
T
F
S
Loading…