What happens when you click Connect?
You are sent to Google's own sign-in page (or Meta's), never the app's. Google shows the app's name and a list of what it wants to do, and you approve or cancel. If you approve, Google hands the app a token, a long string that works like a key cut for those permissions only, and the app never sees your password. The standard behind this is called OAuth, and it is the same thing that happens when you "sign in with Google" anywhere.
The app's maker has hoops of its own to jump through. Google Ads, for example, requires every app that uses its API to hold a developer token that Google has approved (Google Ads API documentation).
What are the permissions on that screen?
They are the limits of the key, and each company names its own. Meta separates ads_read, which lets an app see ad results, from ads_management, which lets it create and change ads (Meta for Developers, permissions reference). Google Analytics has a read-only permission for reports. Read the list before you approve. An app that only needs to read should not be asking to manage, and what an app does with whatever you grant comes down to how it is built and what it promises.
How do you see which apps have access, and take it back?
For Google, open your Google Account, go to Security and find your connections to third-party apps and services; myaccount.google.com/connections lists them. For Meta, Business Integrations in your Facebook settings shows the apps connected to your pages and ad accounts. Removing an app cancels its token straight away. A yearly look is worthwhile, because free trials leave connections behind long after anyone used them.
How many hours do two connected apps save an orchard? (example figures)
An orchard near Shepparton sells fruit boxes online as well as at the farm gate, about 260 online orders a month through Shopify. Each order is copied into Xero by hand as an invoice, at about 3 minutes an order.
| By hand | Through the two APIs | |
|---|---|---|
| Time each month | 260 × 3 minutes: 13 hours | Checking a daily summary: 1 hour |
| Staff time at $35 an hour | $455 | $35 |
| Connector app | None | $30 a month |
| Typing errors in totals and GST | Some, found at BAS time | None from re-typing |
| Monthly cost | $455 | $65 |
The connector sits between Shopify's API and Xero's, reads each new order from one and writes the invoice into the other overnight. It needs permission to read orders in Shopify and to create invoices in Xero, and nothing more.
How does CoraVision use the Google Ads, Meta and GA4 APIs?
CoraVision connects to Google Ads, Meta and Google Analytics 4 through their APIs, and it uses them to read. From Google Ads it reads campaigns, spend, clicks, impressions, conversions and conversion value, budgets and bidding type. From GA4 it reads visits by channel, key events, purchases and revenue, and from Meta, campaigns and ad sets with their spend, impressions, clicks, results and the value of those results. At launch it also reads Google Merchant Center and Google Tag Manager. It reads once on connecting and every night after, never creates, changes, pauses or deletes anything, and cannot post to your pages.
Questions
Is connecting an app through an API safe?
Safer than handing over a password, because the token covers only what you approved and you can cancel it at any time. The risk lies in what you approve, so read the permission screen and connect only apps from makers you would trust with the same access in person.
Why does an app sometimes ask me to reconnect?
Tokens expire or get cancelled, for example when you change your password or remove the app's access, or when Google or Meta tightens its rules. Reconnecting issues a fresh token, and nothing about your data changes in the process.