Discover and connect marketplace apps

The Usable Marketplace helps signed-in users discover available applications and open their connection flows. Availability can depend on application status, install policy, workspace eligibility, and account access.

Do not connect an application until you understand who published it, what it requests, and how to remove its access.

Discover an application

1. Sign in to Usable.
2. Open /dashboard/marketplace.
3. Browse or search the applications available to your account.
4. Open the application detail page.
5. Review its name, developer, description, category, tags, and application URL where shown.
6. Check whether it is beta, active, deprecated, or otherwise limited.
7. Read its connection requirements and requested permissions.

The marketplace listing is not proof that an app is suitable for your data or organization.

Review before connecting

Confirm:

• the developer identity and support contact are recognizable;
• the application URL and redirects use expected HTTPS origins;
• requested scopes match the app's stated function;
• the correct user and workspace are selected;
• the app's access policy allows the intended installation;
• retention, privacy, and removal expectations are acceptable;
• beta limitations are acceptable for the workflow.

Reject unexplained broad permissions. Do not copy credentials into an app's support chat or description.

Connect with browser OAuth

Where the app uses an authorization-code flow:

1. Choose Connect.
2. Verify the authorization page and signed-in account.
3. Review the requested permissions.
4. Approve only if the scope is appropriate.
5. Allow the browser to return to the registered redirect URI.
6. Confirm the app reports a successful connection.
7. Test one low-risk read action.

If the redirect host is unexpected, stop rather than editing the URL manually.

Connect with Device Code

Usable released RFC 8628 Device Authorization Grant support in v1.185.0 and added a Device Code snippet to the marketplace Connect modal in v1.186.0.

For an app that exposes this flow:

1. Start the connection from the app or Connect modal.
2. Note the verification URL and short-lived user code.
3. Open the verification URL yourself.
4. Confirm the app and requested access.
5. Enter the code before it expires.
6. Return to the original device while it polls at the instructed interval.
7. Confirm completion and test access.

Treat the user code like a temporary credential. Never send it to an unknown person or service. A client must handle pending, slow-down, expiry, and denial results rather than polling aggressively.

Verify the connection

After connecting:

• open Installed Apps at /dashboard/marketplace/installed;
• confirm the expected application appears where exposed;
• verify the connected account and workspace context;
• test the minimum expected operation;
• confirm no extra permissions were granted;
• record the integration owner and purpose outside secret values.

Installation, OAuth authorization, and workspace permission are distinct. A connected app can still receive 403 for a workspace action it was not granted.

Maintain or disconnect

Review installed applications periodically. Remove access when the app, user, or business purpose changes.

Use only disconnect, revoke, or remove controls exposed by the current Installed Apps view, the application itself, or supported token/account settings. Do not assume every application exposes the same uninstall operation.

After disconnecting:

1. Confirm the app no longer has working access.
2. Revoke related tokens or sessions where supported.
3. Remove stale app-side credentials.
4. Review downstream automation and data retention.
5. Keep audit details without storing secrets.

Troubleshooting

The app is not visible

It may be draft, unavailable to your account, invite-only, approval-required, workspace-restricted, deprecated, or archived.

Connect returns to an error page

Check the registered redirect URI, account session, requested scopes, and environment. Do not add broad wildcard redirects as a shortcut.

Device Code never completes

Verify the code has not expired, the correct account approved it, and the client follows the displayed polling interval. Start a new flow rather than reusing an expired code.

Connection succeeds but the app cannot read a workspace

Check the user's workspace membership, application scope, and selected workspace. Marketplace connection does not override workspace authorization.

Installed Apps does not update

Refresh once and verify the connection's final result. Do not repeat authorization blindly; this can create confusing duplicate sessions.

Related pages

• Applications and integrations in Usable
• Choose an OAuth grant and application type
• Configure permissions, access, and token security