Skip to main content

LINKING AN APP TO SWAMP SERVE

An app such as a Slack bot can act as you on a swamp serve once you link it. Linking ties your Swamp account to your account in that app, so a request from one can be treated as coming from the other. Nothing is linked until you read a page on swamp-club.com and approve it.

What you see

The app gives you a one-time link. It works for 10 minutes. If you aren't signed in, you sign in first, including through your company's single sign-on, and then return to the page. Reading the page doesn't use it up, so a chat app previewing the link does no harm.

The page shows:

  • Who you're signed in as. Approving links the app's account to this person. If it's the wrong account, use the sign-out option on the page and sign in again.
  • What the app says. The app's name, your account in it, and the workspace. The app supplied these, and Swamp Club can't check them.
  • Where it connects. The collective, and the swamp serve's name and the hostname it reports.
  • What it can do as you. Each workflow and each permission, in plain language.
  • What the serve learns about you.

The app can never do more than you can yourself. What it's allowed is the overlap between your own access and the limit an operative set for the app.

What each permission means

  • Run starts runs of the workflow and cancels any run of it, including runs other people started. Cancelling a run also cancels its suspended child runs, even on workflows the app isn't otherwise allowed to touch. Runs use the secrets the workflow needs.
  • Read sees the workflow and its runs.
  • Approve decides approval steps that are waiting on a person.
  • Signal sends signals to a run in progress, which can change what it does next.

Don't approve a link someone else sent you. Whoever approves becomes the linked person, so anything that account does through the app would run as you.

If the app knows the email address on its account and it doesn't match yours, the page warns you. A swamp serve can also require a match, and then the page refuses. A wrong address only ever refuses someone: it can't link anyone else.

What the serve learns about you

Once you approve, the serve learns your username and email address, and whether you belong to its collective. If you do, it also learns your identity provider groups.

Those groups are held as one list across your whole account, so they can include groups from another collective's identity provider. Your other collectives themselves aren't shared. The serve only reads people linked to it, and after a link ends it can't read anything more about you.

The email, and this wasn't me

After the serve records the link, we email you, naming the workspace and your username. The email goes out even if you've opted out of product email, because it's a security notice.

If you didn't approve this, use the This wasn't me button. It doesn't need you to sign in. Opening it changes nothing, so a mail scanner can't end a link by accident. The link ends only once you confirm on that page.

The app stops acting as you once its swamp serve next checks. Work already running can finish. Afterwards, change your password and tell your collective's admin.

If we can't deliver the email within about 20 hours, we end the link, because you'd have no way to find out about it or undo it. Link the app again if you still want it.

  • The swamp serve ends it, for example when you unlink or an operative revokes the app.
  • You delete your Swamp account.
  • The collective or the serve's OAuth client is deleted.

Leaving a collective doesn't end a link by itself. The serve sees that you no longer belong and decides what you can still do.

If you sign up while linking

If you create a new account with an email address and password, you need to verify the address first, and that returns you to your profile rather than the page. Go back to the app and open the link again. If 10 minutes have passed, ask the app for a new one.

← PreviousAbout Extension Licenses