Your security perimeter includes every vendor you have ever connected, including the ones you stopped using and never disconnected.
A connection is a standing grant. It does not expire because you stopped logging in, it does not lapse because the trial ended, and it does not disappear when you delete the app from your phone. It stays live until somebody revokes it.
Which makes the permission screen — the one everybody clicks through — the actual security model.
The scope ladder
Permissions are not binary, and the difference between rungs is the difference between an inconvenience and a serious incident.
| Scope | Allows | If the vendor is compromised |
|---|---|---|
| Read one thing | See specific data | That data is exposed |
| Read everything | See all data in the account | Your full customer list, mailbox or store is exposed |
| Write | Create and modify records | Data can be altered or destroyed |
| Send as you | Send email from your address | Spam sent from your domain |
| Admin | Change settings, add users, grant access | Full account control, and it can grant itself persistence |
The bottom two rungs deserve real scrutiny, and they are routinely granted to tools that only needed the top one.
The practical question at every permission screen: does this tool need everything it is asking for to do the one thing I want it for? A scheduling tool asking for full mailbox access, or an analytics tool asking to send, is asking for more than the job requires.
The consequence specific to email
A connected tool with sending scope can send email as you, and if that tool is compromised, the spam comes from your domain.
The chain:
- A vendor you connected is breached
- Their access to your mail sending is used to send spam, authenticated as you, because you authorised it
- Recipients complain, and your domain lands on a blocklist
- Your order confirmations, password resets and customer email stop being delivered
Revoking the vendor's access stops the sending. It does not clear the listing. Delisting is a separate process, and a repeat listing for the same cause takes substantially longer to clear than a first one. What removal involves · the same chain arriving via a hacked site.
Which reframes the mail-sending scope specifically. It is not just data exposure. It is an asset — your domain reputation — that other people's security decisions can damage, and that takes weeks to rebuild.
Two practical consequences:
- Grant sending scope sparingly, and only to tools whose job actually requires it
- Include your connected apps in hack triage. If your domain is suddenly listed and your site is clean, a connected vendor is the next place to look. Check your blocklist status
API keys versus OAuth
They fail differently and both need managing.
An API key is a long string that grants access. Typically it does not expire, it often carries broad permissions with no granular scoping, and anyone holding the string has the access — there is no user identity attached.
Where keys leak: pasted into a shared document, committed to a repository, stored in a plugin's database settings and carried into a database export, or emailed to a contractor.
OAuth is better where it is offered: scoped, revocable per application, attributable to an account, and visible in a list.
Its own failure mode is the one people miss: a grant authorised by a personal account is revoked when that account is deleted. So an employee leaving breaks the integrations they set up — weeks later, silently, with no obvious link between the two events. What that looks like when it breaks.
Three rules:
- Prefer OAuth where both are offered
- Authorise from a shared or service account that will outlive any individual
- Store keys outside the database where the platform allows it — a constant in a config file rather than a settings row that ends up in every backup
The quarterly review
Twenty minutes, and it is the only thing that keeps the perimeter from growing indefinitely.
1. List connected applications in every account that matters: email and workspace, store, payment processor, CRM, site, social, analytics.
2. For each, answer three questions:
- Do we still use this?
- What scope does it hold?
- Whose account authorised it, and do they still work here?
3. Revoke anything unused. This is the whole point. Trials, tools you evaluated and rejected, things a former colleague connected. An unused connection is pure exposure with zero benefit.
4. Downgrade anything over-scoped, where the vendor offers a narrower option.
5. Rotate any API key that has ever been in a shared document, and any held by somebody who has left.
6. Record what you removed and why, so it is not reconnected in six months by somebody solving the same problem.
Before connecting anything new
Four checks, two minutes.
- What is the minimum scope this needs? Grant that, not what is offered
- Where is the data processed and retained? If you handle EU or UK personal data this is a compliance question, and the answer should be findable without asking
- Who is authorising it? A shared account, not a personal one
- What is the revocation path? A connection you cannot cleanly revoke is a connection you should not make
And ask what happens to the data if the vendor is acquired or shuts down. Small tools get bought and closed regularly, and "what happens to our records" is a question worth having an answer to before rather than after.
If a connected vendor is breached
Five steps, in order.
- Revoke the connection immediately. Before investigating
- Rotate every credential that vendor held, and anything reused elsewhere
- Check what they could reach — the scope tells you the blast radius
- If they had sending scope, check your domain's blocklist status now. A listing found today is an inconvenience; found in three weeks when customers complain, it is a recovery project
- Check for persistence. An admin-scoped compromise can create users, add its own integrations, or set forwarding rules. Revoking the original connection does not remove what it created
That last point is the one people miss. The equivalent discipline after a site compromise.
Frequently asked questions
What am I actually granting when I connect a tool?
Usually more than the task needs. Scopes range from reading one thing to full admin control, and the two that matter most are sending email as you and administering the account — both routinely granted to tools that only needed read access.
Do connected app permissions expire?
No. A connection is a standing grant that stays live until somebody revokes it — it does not lapse when a trial ends, when you stop using the tool, or when you delete the app. This is why unused connections accumulate as pure exposure.
Can a connected tool damage my email deliverability?
Yes. A tool with sending scope can send as you, so if that vendor is compromised, spam goes out from your domain and your domain gets blocklisted. Revoking the vendor's access stops the sending but does not clear the listing, which is a separate process.
Is an API key or OAuth safer?
OAuth, where both are offered — it is scoped, revocable per application and attributable to an account. API keys typically do not expire, often carry broad permissions, and grant access to anyone holding the string, which is why they leak through shared documents and backups.
Why do integrations break when an employee leaves?
Because connections authorised by a personal account are revoked when that account is deleted. Authorise from a shared or service account that will outlive any individual, and the connection survives staff changes.
How often should I review connected apps?
Quarterly, across every account that matters. Revoke anything unused, downgrade anything over-scoped, and rotate keys held by people who have left. It takes about twenty minutes and it is the only thing that stops the perimeter growing indefinitely.
What should I do if a tool I use is breached?
Revoke the connection before investigating, rotate every credential it held, check the scope to establish the blast radius, check your domain's blocklist status if it had sending access, and look for persistence — an admin-scoped compromise can create users or integrations that survive revoking the original connection.
The short version
- List connected applicationsList connected applications in your email and workspace, store, payment processor, CRM, site, social and analytics accounts.
- Record the scope each one holdsRecord the scope each one holds , and whose account authorised it.
- Revoke every connection you no longer useRevoke every connection you no longer use
- Downgrade anything over-scopedDowngrade anything over-scoped where a narrower option exists.
- Re-authorise personal-account connectionsRe-authorise personal-account connections from a shared or service account.
- Rotate any API keyRotate any API key that has been in a shared document or held by somebody who has left.
- Move stored keys out of database settingsMove stored keys out of database settings into configuration files where supported.
- Grant sending scope only where the job requires itGrant sending scope only where the job requires it
- Record what you revoked and whyRecord what you revoked and why
- Repeat quarterlyRepeat quarterly
- If a vendor is breachedIf a vendor is breached , revoke first, rotate credentials, check blocklist status, and look for persistence.
Free: The 60-Minute Email Authentication Fix
A no-fluff checklist to set up SPF, DKIM & DMARC correctly and pass Gmail & Yahoo's sender requirements.
Muhammad Basim has worked in digital marketing since 2013, focused on email deliverability and AI-assisted content production. He is the author of The Email Deliverability Playbook and The Email Copywriting Playbook.
Related Articles
Does Send Time Optimisation Work?
Send time optimisation models are trained on when recipients opened messages, and open timestamps now include machine activity that has nothing to do with when anyone was reading. Privacy protection pre-fetches message content on its own schedule, regardless of whether the recipient opened it. Security gateways fetch content during pre-delivery scanning, which happens before the […]
Prompting for Marketers: The Part That Actually Matters
Output quality is set mostly by the material you supply, not the phrasing you use. That is the finding people take longest to accept, because it is less interesting than the alternative. A carefully worded request with no context produces a competent generic answer. A plainly worded request with your actual customer language, your positioning […]
Predictive Segmentation and Engagement Scoring
An engagement score built on opens is partly a score of machine activity, and it errs in the direction that costs most. Privacy protection pre-fetches content whether or not anyone read the message. So a contact who has not looked at an email in a year can register as consistently engaged — and stay in […]