Connect apps

Apps that speak Open Payments can ask your node for access, for example to send payments for you up to a limit. You read each request in your wallet, approve or deny it, and can take access back at any time.

Which requests need you

An app asks your node for a grant: a set of things it may do, each with its limits. Your node asks you only when a grant could move your money or show more than the app's own payments:

• sending payments from your wallet;
• seeing all payments or quotes, not only the app's own;
• learning that a wallet address is yours.

Requesting a payment to you, or asking what a payment would cost, moves nothing. Your node grants those at once, without asking, and they do not show under Connected apps.

An app that asks for anything that needs you must name itself by its own wallet address. An app known only by its key is refused, so you always see who asks.

Apps reach your node at its address, over HTTPS. A node with a domain name answers there itself. A node without one, such as the desktop app, is reached through Dassie's front door at <node ID>.dassiepay.net, its relay by default, while it runs. See How others reach you.

Through the front door, apps get only the grants that don't need you. The consent screen below is on your node, and the front door can't send you there yet: it answers that interactive grants need the owner's Dassie app, which is not available yet. To approve apps, run your node on a server with a domain name. What's next

The consent screen

1. The app sends you to your wallet. Your browser opens a page on your node, titled An app asks for access. If you are not logged in, the wallet asks for your recovery phrase first, then shows the request.
2. Read who asks. The app's name, if it gives one, with its wallet address in brackets. Check the address: the name is only what the app calls itself.
3. Read what it asks for. Each item is a line, such as Request payments in your USD wallet. An item that sends payments shows four facts, described below.
4. Approve or deny. If the app asked for it, the wallet then sends you back to the app; otherwise it says you can close the page. Either way, the app learns your answer from your node. If you approved, the page names Connected apps, where you can revoke it.

A request waits ten minutes for your answer. After that, or once it has been answered, the page says it is no longer waiting: start again from the app.

What an app may send

For an item that sends payments, the consent screen says each side as far as it is known, and never guesses:

You send

The most it may take from your wallet, such as Up to $ 10.00 a day from your USD wallet, fees and currency exchange included. This is firm: every fee and every conversion on the way comes out of it. If the app sets no limit, it says Any amount. Read that twice.

They receive

What arrives at the other end. If the app also caps that, it says so. Otherwise it depends on the path, which only a quote measures, so the screen says it depends. If the app names one payment request to pay, your node reads it while you look, and shows its currency and what it still asks for.

To

Anyone the app chooses, or one payment request on another node, with how long it stays open.

Lasts

How often the limit renews, if it does, and until when. A limit without an interval is a total for all payments, not renewed, until you revoke access.

If the app caps what the receiver gets in a different currency than the payment request it names, a warning says The limit doesn't match the payment request: every payment it tries will be refused. You can still approve, but the app will not be able to pay.

Your node refuses some requests before you see them: a limit on what is delivered with no limit on what you send, and a sending limit in a different currency than the wallet it sends from. The first puts no bound on what you send, and no payment could keep to the second.

Why it works this way: what the consent screen says, and which grants need you.

See what apps may do

Open Connected apps in the top menu. Each app you approved is listed by name, with the date you approved it, and each thing it may do on a line, such as Send payments of up to $ 10.00 a day from your USD wallet. Next to a limit is what it has used in the current period, such as $ 3.50 of $ 10.00 spent this period.

The payments an app sends show under Activity, marked with who sent them. See Activity and assets.

Revoke access

1. Open Connected apps.
2. Find the app, and select Revoke.
3. Confirm with Revoke.

The app can do nothing more for you from then on. Payments it already made stay made.