This blog post is part of PagerDuty’s ongoing series on how we’re helping customers navigate their journey towards autonomous operations. Read on to learn about how Scoped OAuth for Public Apps, now in Early Access, builds towards this vision.

Your security team asks a simple question during a routine review: which third-party apps can reach our PagerDuty data right now, and what exactly can they do with it?

You go looking for the answer, and there’s no single place to find it. An API key got handed to a vendor two years ago, and the person who did it left the company last spring. An app someone connected has broad read and write access across the whole account, when all it ever needed was to read incidents. If you wanted to cut any of it off today, you’d be guessing at what you’d break.

You can’t secure what you can’t see. And right now, you can’t see it.

If you’ve ever tried to answer “what has access to our account,” you know this problem. Today we’re closing it with Scoped OAuth for Public Apps.

Announcing Scoped OAuth for Public Apps

Scoped OAuth for Public Apps gives PagerDuty admins one place to see, approve, and revoke every third-party OAuth app connected to their account. Apps request only the specific resource types they need, like read access to incidents, instead of broad access to everything. Developers can publish apps for customers to install across accounts, but nothing runs against your account until an admin approves it.

What it looks like in practice

A vendor sends you a link to connect their app to PagerDuty. It lands you on the app’s installation page, and before anything connects, you can see exactly what’s being asked for: the app’s name, who built it, and the specific list of resource types it wants- not “read and write to your account,” but the actual scopes. That’s what lets you approve an app instead of just trusting it.

Once you install it, you can see every user who’s authorized it. Revoke one person’s connection, or revoke all of them at once, if something looks off and you want to cut access while you investigate, without ripping the integration out. Uninstall it entirely, and every bit of that access goes with it.

And until an admin installs an app, nobody in the account can connect to it. A user who tries gets sent straight back to this page to ask first. There’s no path where an app quietly ends up with access to your data because someone wired it up before your security team ever saw it.

Every third-party app connected to your account is now something you can see, something you approved before it touched your data, and something you can pull back at any time, limited to only what it actually needs. That’s a real answer to “what has access to our account,” and a more secure alternative to handing a vendor an API key and hoping for the best.

The Flywheel Effect

As PagerDuty moves toward autonomous operations, more of what touches your data won’t be a person clicking a button. Integrations, workflows, and AI agents will act at scale, continuously, without someone reviewing every request. That only works if you can trust what’s connected and exactly what it’s allowed to do.

Scoped OAuth for Public Apps builds that trust now, while the number of connected apps is still something you can hold in your head. Every scope explicit, every install approved, every connection revocable in seconds. That’s the access model the next wave of automation depends on, in place before you need it at scale, not bolted on after.

Try It Yourself

Scoped OAuth for Public Apps is in Early Access today. Sign up to try it, or connect with your PagerDuty account team to learn more. Watch the full demo to see how to get set up for OAuth.