---
title: "List connected apps"
method: GET
path: "/v1/me/connected-apps"
tags: ["Connected Apps"]
---

# List connected apps

`GET /v1/me/connected-apps`

Returns the OAuth clients (AI assistants and MCP connectors) the authenticated
user has authorized and that still hold a live token.

Requires a session or a full-access API key. A profile-scoped API key, a
restricted (zrk_) API key, or an OAuth access token is rejected with 403: an
app must not be able to enumerate its sibling authorizations, and connected-app
management is admin-plane.

## Response `200`

Connected apps

- object
  - `connectedApps` ConnectedApp[]
    - `clientId` string
    - `clientName` string — Name the client declared at registration. Registration is open, so this is self-declared and not verified.
    - `redirectHost` string, nullable — Host of the client's registered redirect URI (non-http schemes are shown as scheme//host). The destination an impostor cannot fake.
    - `scopes` string[] — Scopes granted on the most recent token.
    - `authorizedAt` string, date-time, nullable
    - `lastUsedAt` string, date-time, nullable — Last time any of the client's live tokens authenticated a request.
    - `tokenCount` integer — Live tokens held by the client (an active session is typically one access plus one refresh token).

## Other responses

- `401` — Unauthorized
- `403` — The API key is a restricted key (zrk_ prefix) and may not perform this operation. Three cases. (1) The operation's resource group (see the operation's x-resource-group) is disabled on the key: fix it by creating a key with the group enabled in the dashboard API keys tab and revoking the old one. (2) The operation is admin-plane (x-resource-group admin-plane: API keys, invites, connected apps, member identity), which is never grantable to restricted keys; the error reads "Restricted API keys cannot manage API keys, invites, or member identity." and the fix is a full-access key or the dashboard, never a new restricted key. (3) On webhook subscription writes, delivery-log reads and replays, a named event maps to a resource group the key does not hold, so a restricted key can never create or edit a subscription broader than itself (a no-messages key cannot subscribe to, test-fire, redeliver or read logs for message.* events).

---

[API](https://skmtc.net/zernio/apis/zernio-api.md) · [All operations](https://skmtc.net/zernio/apis/zernio-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/zernio/zernio-api/revisions/875093317201/schema)