When you connect Kanorio to tools like ChatGPT, Claude, Gemini, Zapier, or Make, you don't need to copy any keys yourself: the tool will automatically open the Kanorio authorization page. Once you confirm the scope and click "Allow," the connection is established. All connections created this way are listed under "Account Settings › API Access › Authorized Apps", where you can view or revoke them at any time.
"Authorized Apps" follow the exact same permission rules as API Keys. The only difference is who manages the credentials:
Authorized Apps (OAuth links): Credentials are automatically managed and refreshed by the app. You never see a password string and don't need to manually rotate keys—it's the most convenient method.
API Keys: You manually create and copy a key starting with knr_pat_ into your tool's configuration. The advantage is that you can granularly select permissions and set expiration dates yourself.
How to read the authorization screen
After initiating a connection from an external tool, your browser will open the Kanorio authorization page. We recommend reviewing these 5 sections from top to bottom:
App Name and Brand Icon
The header displays "Authorize '{App Name}' to access your Kanorio account." Cloud services that can be verified via official domains (e.g., ChatGPT, Claude, Zapier) will show an official brand icon. Tools that cannot be verified via domain will show a generic robot icon with a yellow warning (see the next section for how to judge this).
Source and Redirect URL
"Source" is the official domain provided by the app; "Redirect to" is the URL the browser will return to after you click "Allow" (or back to a local program on your computer). Both should match the tool you are currently using.
Currently Logged-in Kanorio Account
Displays "Logged in as {your email}." If you have multiple Kanorio accounts and are logged into the wrong one, click "Deny," switch accounts, and re-initiate the connection from the tool.
What this app will be able to do (Requested Permissions)
Lists the actions the app is requesting (click "View permission details" for plain-language explanations):
Permissions are requested by the app itself and cannot be modified directly on this screen.
If the app does not specify permissions, Kanorio automatically applies a safe "Edit Content" default plan (allows viewing data, modifying pages, and blog drafts, but excludes publishing sites, taking sites offline, or sending newsletters), marked as "Default applied" above the list.
If the app was previously connected and you are seeing this page again because you asked it to perform a higher-permission action (like publishing a site), the screen will retain the original permissions and mark any new items as "New".
Accessible Websites (You decide the scope)
You can freely choose here:
Select specific websites (Recommended): The app can only touch the sites you select; all other sites remain isolated.
All websites (including future ones): Includes existing sites and any sites you create later. Only select this if you want the AI to build new websites from scratch for you.
Double Security Safeguards:
Permissions never exceed your member role: Regardless of what the app requests, it can never do more than what your member role allows on that site. For example, if you are a "Viewer" on Site A, the app can only view, not edit, on Site A.
High-risk operations are always excluded: Exporting data, downloading form attachments, refunding orders, deleting contacts, sending newsletters directly, changing site currency, managing members, handling billing, and transferring site ownership are never available to any external app.
What does "Cannot verify identity" mean?
App display names are provided by the external tools themselves. To prevent malicious programs from impersonating well-known brands, Kanorio only displays a brand icon when it can technically verify that the connection originates from an official domain. If it cannot be verified, both the authorization page and the Authorized Apps list will display "Cannot verify identity" (or "Unverified").
When is "Cannot verify identity" normal?
When using local tools (e.g., Cursor, Claude Code, Windsurf) with OAuth links: These tools are installed on your personal computer. After clicking "Allow," the authorization result is sent back to the program on your computer (the screen will prompt "After completion, it will return to the program on this device"). Because any local program can use the same local return address, Kanorio cannot verify its identity from the cloud. As long as you confirm it is the screen that popped up after you clicked to connect in your computer tool, you can safely click "Allow."
Internal tools developed by you or your team's engineers.
When is it a phishing warning? (Please click "Deny" immediately)
You did not click to connect Kanorio in any tool, but this page popped up after clicking a link in a suspicious email, forum, social media DM, or external webpage.
The app name claims to be a "ChatGPT Official Connector" or "Claude Assistant," but does not show an official brand icon and instead displays a "Cannot verify identity" warning (Genuine ChatGPT and Claude cloud connectors will always show a brand icon, and the return URL will be chatgpt.com or claude.ai).
Name, Icon, and Official URL: Verified apps show a brand icon and official URL; local or unverified tools are marked "Unverified."
Authorized Date and Last Used: Shows when you first clicked "Allow" and the last time the app performed an action on your site (if never used, it shows "Never used").
N Connections: If you authorized the same app on multiple devices (e.g., work and home computers) or authorized it multiple times, they are merged into one row showing the connection count.
Permissions and Accessible Websites: Shows the total permissions the app has obtained and the scope of websites it can access.
Connection Expiry, Modifying Scope, and Revoking Access
When do connections expire?
Active use extends the connection: As long as the app is used within a 30-day window, the credentials are automatically refreshed in the background; no manual action is needed.
Auto-expiry after 30 days of inactivity: If an app has no activity for 30 consecutive days, the connection automatically expires and is removed from the list to reduce the risk of long-term idle authorizations. If you want to use it again later, just go back to the tool, reconnect, and click "Allow" once.
Want to modify permissions or accessible websites?
Existing connections cannot be modified directly in the list. You have two options:
Re-authorize (Modify accessible websites): Click "Revoke access" on the right side of the list, then go back to the external tool to reconnect and select the websites you want to grant access to.
Switch to API Keys (Custom permission details): If you are using a tool that supports API keys (e.g., Cursor, Claude Code, n8n) and want to granularly specify "View only" or custom permission sets, revoke the OAuth access and connect using an instead.
Revoking Access
Find the app in the list and click "Revoke access" on the right:
The connection will immediately expire on all devices.
If an AI assistant is currently performing a task, its next action will be denied. However, any pages or blog drafts already written will be preserved; you can check them in the "Edit Website" dashboard and decide whether to keep or revert them.
We recommend periodically reviewing your list and revoking access for tools you no longer use.
What to do if you see an unrecognized app?
If you see an app in your "Authorized Apps" list that you don't remember authorizing, follow these 4 steps:
Revoke access immediately: Click "Revoke access" next to the app to cut off its access right away.
Check site drafts and public status: Go to "Edit Website" and "Blog" for each site to check for unexpected draft changes or pages published without your consent.
Log out of other devices and enable 2FA: Since "Authorized Apps" require clicking "Allow" while logged into your Kanorio account, seeing a strange app usually means your account was logged in elsewhere. Immediately go to "Account Settings" to log out of all other devices and set up 2FA or a Passkey (see ).
Contact Support: If you find that site content has been tampered with or you need further investigation, please contact us via .
FAQ
Absolutely not. External apps can only operate on site content through the permissions you approve. They cannot read your login credentials, 2FA codes, recovery codes, or credit card numbers, nor can they view or change billing and subscription plans.
No. Each authorization is tied to the specific Kanorio personal account that clicked "Allow." When team members need to use their own tools, they should log in and authorize using their own Kanorio accounts. The actual scope of access will automatically be limited by that member's role on the site.
Please rely on the list shown on the Kanorio authorization page. The text in the external tool's interface is a summary written by that tool; the actual permissions the app receives in Kanorio are strictly determined by the items you saw and clicked "Allow" for on the Kanorio authorization page.
Because the external tool's own settings screen does not receive real-time notifications of your revocation. However, the connection credentials have been immediately invalidated on the Kanorio side. The next time the tool attempts to read or modify the site, it will receive an unauthorized error. If you are sure you won't use it again, you can also remove the Kanorio connector in that tool's settings.
