Permissions and access

Choices at sign-in

Roles set the ceiling

Roles are ordered: viewer, then member, then admin.

What apps and keys can never do

These actions need you signed in to Praxis in a browser, whatever your role:

• Delete tickets.
• Change settings, such as a project's key or webhook secret.
• Invite people or manage members.
• Create, or mint, keys.

So a leaked key cannot create its own successor, invite anyone or delete work. Keys also cannot change note sharing or organization Notes defaults.

Change or end access

1. 01Open your organization's Settings › AI tools.
2. 02Signed-in apps are listed as Signed-in app. Personal keys are listed with their expiry and last use.
3. 03Choose Edit access to change an app's projects or permissions.
4. 04Choose Disconnect to end an app's access straight away.

Removing someone from an organization also revokes their keys there.

How long sign-ins last

Access token

1 hour, renewed automatically

Refresh token

90 days, extended each time it is used

Authorization code

10 minutes, single use

Personal key

30 days, 90 days, 1 year or never, chosen when created

A signed-in app stays connected while you use it and expires after 90 days without use. Each refresh replaces the refresh token. If an old one is reused after 60 seconds, Praxis treats it as theft and disconnects the app.

Tool annotations

Every tool tells the app what kind of action it is. ChatGPT and Claude use this to decide when to ask you before a call.

• Read-only: the 17 read tools listed in the tool reference.
• Destructive: update_issue, bulk_update, unlink_issues, edit_update, edit_update_media, edit_note.
• No tool reaches outside Praxis.