Connect Third-Party Applications

---

What Are Third-Party Applications

Third-party applications use HAP’s standard OAuth 2.0 authorization mechanism. After user consent, these applications can securely access or operate user data in HAP on behalf of the user. By using short-lived credentials (Access Tokens), this approach is more secure and controllable than long-term key-based methods.

With third-party applications, you can:

• Access resources in HAP as the user
• Perform actions on behalf of the user (e.g., create or update records)
• Restrict access capabilities through API scopes

Organization Admin Controls

Entry Point

Go to [Org Admin] > [Integration] > [Connected Apps] to access the management page.

This page lists all external official integrations connected to HAP. To enable cross-platform collaboration, HAP will gradually be made available in marketplaces such as GPT, CodeX, and Claude Code.

Management Actions

1. Configure Data Access Scope

   API Permissions:
   View the specific API capabilities requested by the application (e.g., read-only, write access)

   Application Scope:
   Specify which applications or worksheets within the organization the connected app can access

   

2. Enable / Disable Integration

   Admins can disable third-party application access at any time. When an application is disabled, the system enforces the following security measures:

   • Immediate revocation:
     All issued Access Tokens become invalid immediately, and API requests return unauthorized errors

   • Authorization invalidation:
     All user authorizations are marked as expired, and Refresh Tokens can no longer be used to obtain new tokens

   • Access blocked:
     New authorization attempts are denied

   • User-side changes:
     Only historical authorization records remain visible in user accounts; no further data interaction is allowed

   Click Disable Integration in the top-right corner to disable all application integrations.

User Authorization Flow

• Initiate authorization:
  Click Log in to HAP in the third-party application

• Review permissions:
  Verify the requested scopes in the authorization prompt

• Complete authorization:
  Once confirmed, the application can operate within the granted permissions

• Manage authorization:
  Users can revoke access anytime via
  [Profile] > [Account Settings] > [Authorization Management]

Example: HAP API (Personal Authorization)

Using HAP API (Personal Authorization) from the Integration Center as an example, the process is as follows:

1. Install API Template

   

2. Add Account

   

3. Authorize

   

4. Revoke Authorization