--- title: Authorizing Third-Party Applications with OAuth url: https://www.fastbound.com/faq/authorizing-third-party-applications-with-oauth/ description: "Authorizing an application Authorization starts in the application you are connecting, not in FastBound. The application sends you to a FastBound page that asks for your approval. In the third-party application, start the connection to FastBound Sign in to FastBound if you are prompted Under Select the FastBound account to authorize, choose the account the… Continue reading Authorizing Third-Party Applications with OAuth" --- Authorizing an application Authorization starts in the application you are connecting, not in FastBound. The application sends you to a FastBound page that asks for your approval. In the third-party application, start the connection to FastBound Sign in to FastBound if you are prompted Under Select the FastBound account to authorize, choose the account the application should connect to Review the list under This will allow, which shows everything the application will be able to do in that account Click Authorize to approve, or Cancel to deny access After you click Authorize, FastBound sends you back to the application and it is connected to the account you selected. Note: An authorization covers one account. If you have more than one FastBound account, authorize the application once for each account it should connect to. Authorizing a device with a code Some applications, such as desktop software and devices without a web browser, show you a code and a web address instead of sending you to FastBound. Open the web address shown by the application on your computer or phone and sign in to FastBound Enter the code in Device Code if it is not already filled in, then click Continue. The code is not case-sensitive Confirm the code on the page matches the code on your device Select the account, review what the application will be able to do, and click Authorize or Deny When you see Device Authorized, close the window and return to your device. Codes expire after about ten minutes, so if yours is rejected, start again from the application to get a new one. Who can authorize an application You can authorize an application for an account if you own the account or you are a user with the Account Settings permission. The account’s plan must include API access. Accounts that do not meet both conditions are not listed when you authorize. Viewing authorized applications Open Account Settings Click the Tokens tab Authorized OAuth Applications lists each token with the Application it belongs to, the Grant Type used to authorize it (Authorization Code or Device Code), and the date it was Created. Click an application’s name to switch between the name and a partial preview of its token. The full token is never shown. An application appears once for each token it holds, so the same application can be listed more than once. Each application is limited in how many tokens it can hold for one account. If authorizing fails because the limit has been reached, delete the application’s existing token and authorize it again. Deleting a token to revoke access Only the account owner can delete a token. Other users see a message naming the account owner to contact. On the Tokens tab, click the trash icon on the application’s row In Delete API Token, read the warning. Deleting the token immediately disconnects the application that uses it. Other applications and Legacy API Keys are not affected Check I understand Click Continue When API Token Deleted appears, click OK The token is deleted immediately, and the application that used it can no longer access your account with it. To reconnect the application later, authorize it again. Note: Delete a token as soon as you stop using an application, or if you believe the application or its vendor has been compromised. OAuth tokens and Legacy API Keys The Tokens tab also lists Legacy API Keys. A Legacy API Key gives unrestricted access to your account and is shared by every integration that uses it. An OAuth token belongs to one application and is limited to the permissions you approved. Legacy API Keys continue to work, and we recommend OAuth when the application you are connecting supports it.