Approving a connection
Connecting an assistant to LevelFour sends your browser to an approval screen on the dashboard. You sign in with the LevelFour account you already have, choose whether the assistant may act as well as read, and approve. Nothing is granted until you do.
The screen shows three things, and each one is worth reading before you click.
| On the screen | What it means |
|---|---|
| Connect X to LevelFour? | The name the application registered under |
| Codes will be sent to | The address that receives the authorization code |
| You are approving this for | The organization that gets the access |
"We have not reviewed this application"
Some connections show a notice first, before the approval screen itself.
Any application can register with the LevelFour MCP server without asking us. The protocol is designed that way: an assistant discovers the server, registers itself, and asks you for access. When it registers, it types its own name, so the name is not evidence of who wrote it. An application calling itself "Claude Code" was not necessarily written by Anthropic, and LevelFour cannot tell you either way.
A hosted client is different. Claude and ChatGPT identify themselves with a metadata document served from claude.ai, claude.com or chatgpt.com, and serving that document requires control of the domain. Those connections skip the notice, because the domain proved what a typed name cannot.
You will meet the notice again on a new machine, after reinstalling an assistant, and sometimes after an upgrade. Each registration is a separate application even when the name is identical, so approving one does not cover the next, and it does not cover a teammate.
What carries signal instead
The name proves nothing. Two other things on the screen do.
Did you start this? You should have just run a connect command or clicked a connect button. If the page appeared on its own, or someone sent you the link, refuse.
Where will the codes go? For an assistant on your own machine, expect localhost with a port, for example http://localhost:3118/callback. For a hosted assistant, expect that product's own domain. An address you do not recognize is the signal to refuse.
The organization
You grant access to one organization: the one your session is currently in, shown under You are approving this for. The application does not choose it and cannot change it. If it names the wrong organization, refuse, switch organizations in the dashboard, and start the connection again.
A connection to one organization cannot read another. If you work across two, connect twice and keep the entries under different names.
Read, or read and act
The Also allow changes checkbox is the whole difference between an assistant that reads your cost data and one that can also act on it. The application asks; you decide. Leave it off and every read tool still works.
Refusing is enforced at the server, not left to the assistant to respect. The catalogue is filtered per credential, so a read-only connection never sees the tools that write, and an agent holding one cannot call them by name.
Acting means recording a decision in LevelFour: accepting or rejecting a savings recommendation, or marking what you concluded about a detected spike. It never lets an assistant change anything in your cloud accounts. Applying an accepted recommendation runs from the dashboard or the l4 CLI.
Approving is limited to organization administrators, because completing one hands out a credential. If you are not one, ask an administrator to start the connection themselves rather than forwarding them the link. The link is live, and anyone who opens it can approve on the organization's behalf.
Refusing
Refuse ends the request for good. The application is told, and the same link cannot be approved afterwards, so nobody can talk you into opening it again later.
An approval request is live for ten minutes and can be used once. Leaving the page alone is enough to let one lapse.
Seeing and closing connections
Settings > API Keys > Connected Applications in the dashboard lists every approved connection: the application, the address its codes go to, whether it holds read or read and write access, who approved it, and when it was last used.
Close connection takes effect immediately. The application cannot renew, and the credential it is holding stops working on its next call. It can ask again, which you are free to refuse.
Close any connection you do not recognize, then tell your security contact.
Next
- Connecting a client has the configuration each client expects
- Tools is what an approved connection can call