Connected Apps
A list of third-party apps that the account owner has allowed to work with your business data — for example, a service that takes orders or prepares sales reports. Here you can see what each app can access and revoke that access. A third-party app is connected from the app itself; on this page the owner can create a personal integration — a key for their own scripts and services.
How to Access
Settings → Integrations section → Connected Apps (/settings/connected-apps).
If the item is not in your menu, connecting apps is not available in your dashboard yet.
How an App Gets Access
- You start the connection in the app itself.
- The app opens a confirmation screen on our server (Paloma365 or PalomaPOS, depending on your market). If you are not signed in to the dashboard as the account owner in that browser, the screen asks you to sign in and press Continue.
- The screen shows which app and which developer is asking for access, exactly what the app will be able to do and which site it returns you to afterwards. If the developer registered the app on their own and the team has not reviewed it, the screen warns you — connect such an app only if you know the developer. The owner presses Allow or Cancel.
- Once the owner agrees, the app appears in the list on this page.
Only the account owner can give consent — the person who signs in to the dashboard with the account credentials, not with an employee login. An employee sees a message on the confirmation screen asking them to contact the owner. A support specialist working in your dashboard cannot connect an app.
What You See for Each App
| Field | What it shows |
|---|---|
| Name and developer | What the app is and who made it |
| Connected | When the owner gave consent and, if known, who it was |
| Last used | When the app last used its access, or "Hasn't used its access yet" |
| Access | What the app can see or do (see below). Access that changes data is highlighted |
| Privacy policy, Terms of use | The developer's documents; they open in a new tab |
Personal integrations show a Personal integration badge instead of a developer and documents, and "Created" (when and by whom) instead of "Connected".
What Access an App Can Get
An app gets only what the owner agreed to on the confirmation screen. The same list is shown in the Access field:
| Access | What it allows |
|---|---|
| Business profile, locations, hours, taxes and payment types | Data about the business and its locations |
| Catalog: items, modifiers, menus, stop list | Categories, items, modifiers, menus and the stop list |
| All orders: lines, payments, statuses | All orders — lines, discounts, taxes, payments and statuses. Guest details in orders only together with access to the customer base |
| Create orders and cancel its own orders | Create orders; the app can cancel only orders it created itself |
| Mark its own orders as paid outside the POS | Mark as paid only orders the app created itself |
| Sales reports | Sales totals by day and by item |
| Customer base and guest personal data | Customers and guest details: name, phone, address |
| Employees and shifts | Employees and shifts, without passwords |
| Works while you're away | The app keeps working until you revoke its access. If the app does not renew its access for 90 days, the access expires. Without this item, access lasts about an hour after consent |
How to Revoke Access
- Next to the app, click Revoke access.
- Confirm in the dialog.
The app loses access to your business data immediately and disappears from the list. To use it again, connect it once more from the app itself and give your consent again.
Only the account owner can revoke access: employees see the list without the Revoke access button. A support specialist working in your dashboard cannot revoke access either.
Personal Integration
If you want to connect your own script, spreadsheet or service to your business data, you don't need to register as a developer — create a personal integration. It uses the same API as connected apps, but instead of a confirmation screen you get a key right away.
- The key gives access only to this account's data and only to what you selected when creating it.
- The key does not expire: it works until you delete the integration.
- The key is shown once. You can't view it again — if the key is lost, delete the integration and create a new one.
- You can create up to 20 integrations.
How to Create One
- Click Create integration (only the account owner has this button).
- Enter a name — for example, "Reports in Google Sheets".
- Select what the integration can do. The business profile, catalog and orders are selected by default — read-only. Access that changes data is marked "changes data".
- Click Create.
- Copy the key and store it somewhere safe. The same window has a ready example request and a link to the API documentation.
- Click Done, I saved the key. The integration appears in the list with a Personal integration badge.
The key goes in the request header: Authorization: Bearer <key>. More in API for developers.
How to Delete One
- Next to the integration, click Delete.
- Confirm in the dialog.
The key stops working immediately and cannot be restored. To keep working, create a new integration and replace the key wherever it is used.
Only the account owner can create and delete personal integrations. A support specialist working in your dashboard cannot do it.
For Developers
At the bottom of the page there are links for app developers: the API documentation, the file an AI tool can start from, and the Developers page, where a developer registers their own app and gets keys at once.
Tips
- Review the list from time to time and revoke access for apps you no longer use.
- Keep your personal integration key like a password: don't send it in chats or publish it in public code. If the key may have leaked, delete the integration and create a new one.
- Give your personal integration only the access it really needs.
- Before you press Allow, check on the confirmation screen that the app really needs every access it asks for — especially access that changes data or opens guests' personal data.
FAQ
Q: How do I connect an app to my business?
A: From the app itself: it opens a confirmation screen where the account owner signs in to the dashboard and agrees to the access the app asks for. After that, the app appears in this list.
Q: The page says "Connecting apps is not available yet"
A: Connecting third-party apps is not switched on yet on your account's server. There is nothing you need to do.
Q: I revoked an app's access by mistake
A: Connect the app again from the app itself — you will be asked for your consent once more.
Q: An app disappeared from the list, but I did not revoke its access
A: An app can disconnect itself. The server also revokes access on its own when it notices that the same access key was used twice — a sign that the key has leaked. To keep using the app, connect it again from the app itself.
Q: An employee does not see the "Revoke access" button
A: That is expected: only the account owner can revoke access. Employees can see the list but cannot change it.
Q: I closed the window without saving my integration's key
A: The key can't be shown again — only you have it. Delete the integration and create a new one to get a new key.
Q: There is no "Create integration" button
A: Only the account owner sees it, and only where connecting apps is already switched on. When 20 integrations exist, the button is disabled — delete one you no longer need.
Q: How is this different from the AI Connector (MCP)?
A: The AI Connector (MCP) page (if your dashboard has it) holds tokens you create yourself for your own AI assistant. Connected Apps are third-party services that got access through the confirmation screen, plus your own personal integrations working through the Platform API. They are independent: revoking access on this page does not affect AI Connector tokens, and vice versa.