---
title: "List OAuth clients (MCP clients) the caller has connected"
method: GET
path: "/me/connected-apps"
---

# List OAuth clients (MCP clients) the caller has connected

`GET /me/connected-apps`

## Request

- Base URL: `https://craaft.io/api/v1`
- URL: `https://craaft.io/api/v1/me/connected-apps`
- Auth: API key in cookie `craaft_session`

Session-only - see the `sessionAuth` scheme description above for
why. Backs Settings → Connected apps in the UI. Newest grant first.

## Response `200`

OK

- ConnectedApp[]
  - `id` string, uuid, required: The grant id. Pass this to DELETE /me/connected-apps/{id} to revoke.
  - `clientName` string, required: Name the client supplied at dynamic registration (RFC 7591).
  - `redirectHost` string, required: Host (with port, if non-default) of the client's registered redirect URI - shown so the user can recognise which app this is beyond just its self-reported name.
  - `verified` boolean, required: True for a small allowlist of known first-party MCP client hosts (currently claude.ai and claude.com). Any other client can self-register via dynamic client registration, so this is a hint, not a security boundary.
  - `createdAt` string, date-time, required: When the grant was first approved.
  - `lastUsedAt` string, date-time, nullable, required: Last time this grant's access token was used. Null if never used since approval.

## Other responses

- `403`: Browser session required - a bearer token (`cra_` or `cro_`) was used against a session-only route and is refused identically to either scheme.

---

[API](https://skmtc.dev/craaft/apis/craaft-api.md) · [All operations](https://skmtc.dev/craaft/apis/craaft-api/llms.txt) · [OpenAPI document](https://skmtc.dev/craaft/apis/craaft-api/revisions/3a1e9d30d7dc?raw)