---
title: "Access and disconnection"
description: "Minimum permissions and revoking access."
group: "Product"
order: 6
---

## Deployment addresses

- Documentation: https://ctx4.me/docs.md
- Agent index: https://ctx4.me/docs/agent-index.json
- Console and connections: https://console.ctx4.me/integrations
- MCP: https://ctx4.me/mcp
- HTTP API: https://ctx4.me/v1
- Composio base URL: https://ctx4.me/compat/context4/v1
- OpenAPI: https://ctx4.me/docs/openapi.json
- HTTP/MCP inventory: https://ctx4.me/docs/api-index.json
- Composio routes: https://ctx4.me/docs/compat-routes.json
- Connectors: https://ctx4.me/docs/connectors.json


[Open this deployment's console and connections](https://console.ctx4.me/integrations).

## Grant only what is needed

Connect only accounts you are authorized to manage. Check member permissions and tools before use.

## Revoke access

Disconnect the connection in Context4 and revoke permissions in the provider's settings. Rotate a key if it has been exposed.

## Data processing

Request and response content is proxied without persistent storage in Context4. Disconnection and account-data deletion are separate actions; the external AI rules apply to data it has already received. See the [Privacy Policy](https://ctx4.me/privacy), [Terms](https://ctx4.me/terms) and [data handling guide](https://ctx4.me/docs/data-handling.md).

## Three independent types of access

| Access | What to revoke |
| --- | --- |
| AI client to Context4 | OAuth grant or its token family |
| Application to Context4 API | API key in the console |
| Context4 to an external service | Connection and provider-side authorization |

Revoking one does not replace checking the others. For example, disconnecting an AI client does not remove a connected CRM account or delete your Context4 account. Removing a member or archiving a workspace stops subsequent OAuth MCP access.

## Shared accounts

Share an account only with the users who need it. For compat execution with a supplied `user_id`, the platform checks tenant, principal, sharing and deny-first ACL. An explicit `connected_account_id` without `user_id` is the exception: it uses the API key's tenant boundary without principal or sharing/deny-first ACL checks. A session can impose additional limits. Do not infer organization management permissions from a single technical API scope.