Personal agents

Settings → Developers → Personal Agents — create and manage personal OAuth clients for your own Entergram MCP access.

A personal client acts only on your own seat. Use one for a local agent like Claude Desktop or Codex, or for a hosted tool like n8n that should be limited to your data.

Personal clients are private to your seat. Shared workspace clients and higher-risk scopes live under Workspace OAuth clients.

Creating a client

Create client:

Field	Notes
Client name	e.g. Entergram Personal Agent
Platform	Pick your app, or Custom
Token endpoint auth	`none` (public + PKCE), `client_secret_post`, or `client_secret_basic`
Require PKCE	Mandatory for public clients; keep it on for confidential ones too
Description	Shown on the consent screen
Redirect URIs	One per line. HTTPS required outside localhost
Allowed scopes	See below

Use none for local PKCE clients. Use client_secret_* for hosted or server-side integrations that still act only on your own seat.

Scopes available to personal clients

Personal clients can request only:

seat-safe read scopes,
actor-scoped chat custom field access,
optional offline access (stay connected).

Members are further limited: “Member clients can request safe read scopes, actor-scoped chat custom field access, and offline access only.” Admins get a wider set.

Select at least one scope or the client won’t save.

The client secret

Confidential clients receive a secret shown only once:

One-time reveal — Entergram stores only a hash of this secret. After closing this dialog, you will only be able to rotate it, not reveal it again.

Copy it into your secret manager before closing. If you lose it, Rotate secret issues a new one (and invalidates the old).

Managing a client

Each client shows Public client / Confidential client, PKCE on / PKCE off, Created, Last used, Owner and Active grants. Expand for Client details — Client ID, auth method, secret preview, PKCE requirement, last used by, redirect URIs.

Action	Effect
Edit	Change name, scopes, redirect URIs
Disable	”The client will stop receiving new authorizations and token refreshes until you enable it again.”
Enable	Re-allow authorization and refresh
Rotate secret	New secret, shown once
Archive	”Archiving disables the client and revokes your active grants and refresh tokens.”

Statuses: Active, Disabled, Archived, Banned.

Authorized apps

Authorized apps — review and revoke MCP OAuth grants issued by your seat.

Each grant shows when it was Granted, how many Refresh tokens exist, whether PKCE was required, and the Granted scopes.

Revoke access kills it:

Revoking a grant immediately removes stored refresh tokens for that app. The client will need to complete OAuth again before it can reconnect.

Empty state: “OAuth grants will appear here after you connect a local or hosted MCP client to Entergram.”

Good practice

One client per tool. Revoking Claude Desktop shouldn’t break your n8n workflows.
Skip offline_access for anything you only use interactively — it’s what keeps a client connected without you present.
Check Last used quarterly. A client that hasn’t been used in months should be archived.
Don’t grant messages.write to an agent you’re still experimenting with. It sends Telegram messages as you.