Control Who May Connect¶
Info
New in Atfinity 17.
Two settings decide whether a tool may create its own OAuth client for your tenant, and the installation-wide one wins.
Your tenant setting, "Allow MCP clients to register themselves", sits under Integrations in Integration services. It is off until you turn it on, so until then a tool needs credentials an administrator created for it.
The installation-wide setting has three states.
| State | What it means for a tenant |
|---|---|
| Off | No tenant may let tools register themselves, whatever its own setting says |
| Per tenant | Each tenant decides for itself |
| On for all tenants | Every tenant allows it, whatever its own setting says |
Turning self-registration off only stops new clients appearing. A client that registered earlier keeps working, and access anyone already granted stays granted.
Seeing what has access¶
The OAuth Clients tab under API lists every client for the tenant, with what each may currently do and whether an administrator created it or it registered itself.
A client reads as having no access both before anyone grants it anything and after its access has lapsed for good, which is the signal that revoking it would change nothing.
Ending access you have granted¶
Revoking a client ends its access immediately and cannot be undone. Every token it holds stops working, including the renewal that would otherwise have carried it another thirty days.