# OAuth consent and per-app scopes

> What the Pumati OAuth consent page asks, the read, write and publish scopes per app, and how to revoke a connection.

When a client connects, pumati.app shows a consent page with the client's name and where it returns (for Claude Code, Codex and Cursor a program on your own computer, for claude.ai and ChatGPT their own site). The request is valid for 15 minutes. You choose:

- **Scopes for each of your apps.** An app you leave unticked is not listed and can't be used by this connection.
- **Whether it may create new apps**, and the scopes those apps get. Creating needs write.
- **A spend limit** in credits ([spend limit](https://pumati.app/es/developers/spend-limit.md)).

## Scopes

| Scope | Allows |
| --- | --- |
| `read` | `list_apps`, `list_app_tests`, `get_test`, `wait_for_updates`, `list_feedback`, `get_feedback`: missions, results and feedback |
| `write` | `upsert_app` (rename), `register_build`, `create_test`, `create_comparison`, `update_test`, `record_resolution`, `create_retest`: drafts and records, nothing spent |
| `publish` | `publish_test`, `adjust_test`, `cancel_test`: reserve or return credits and start, change or stop recruiting. `review_feedback`: judge submissions (approving pays testers) |

Write and publish always include read: an agent that changes something can see what it changed.

## Token scopes

A client may also ask for fewer scopes in its OAuth request (`read`, `write`, `publish`). A call is allowed only when both the token and the app's grant have the scope; otherwise it is `FORBIDDEN`. A connection only ever sees its own apps: an app the grant doesn't name, and every mission and feedback in it, is `NOT_FOUND`, the same as one that doesn't exist.

## Revoke

[pumati.app/dev/mcp](https://pumati.app/dev/mcp) lists your connections with their apps, scopes and spend. Revoking takes effect on the next call (`FORBIDDEN`); every tool call reads the grant, so there is no cached access.