Third-party apps hold access to your PagerDuty data, and until now you had no single place to see which apps those were, what each one could reach, or who had granted it access. Scoped OAuth apps give you that visibility and control. Before a public app can access data in your account, an Admin must install it. From there you can see every installed app, review the scopes each app is allowed to use, see who in your account has authorized an app, revoke tokens, and uninstall apps.

Third-party developers build these apps to integrate their services with PagerDuty — for example, monitoring who retains access to your account, or mapping their triage process to your on-call schedules. Scoped OAuth apps are built on the industry-standard OAuth framework and use scopes to limit the kind of resources an app can access. For example, an app can be limited to reading and writing incidents, or to only reading service data.

📘
Early Access
Scoped OAuth public apps are in Early Access. Integrations OAuth Apps appears only on accounts enabled for Early Access. If you do not see it, your account is not yet enabled.

⚠️
Required User Permissions
The Account Owner and Admins can install and uninstall apps and revoke tokens across the account. Anyone in your account can view installed apps and revoke their own authorizations. If you are not sure which role you have, visit User Roles.

How Scoped OAuth Apps Work

Scopes

Scopes define the resource types an app can access, and whether it can read or write them — for example, incidents.read or services.write. When an Admin installs an app, they review and approve the scopes the app requests. Access tokens issued to the app are limited to the scopes approved at installation, even if the developer later updates the app to request more. Scopes follow the principle of least privilege — an app can access only the resource types you approve, and nothing else.

For the full list of scopes and the API endpoints they gate, see OAuth Functionality in the developer documentation.

Public and Private Apps

Public apps are built by third-party developers, reviewed and approved by PagerDuty, and work across accounts. Public apps must be installed by an Admin before they can access your account.

Private apps are created by your own account for your own use. They do not require installation, and you manage them separately from the Manage Private Apps page.

Classic and Scoped Apps

Classic User OAuth is PagerDuty's legacy app type. Classic apps do not use resource-type scopes and continue to work as they do today. Classic apps that have been authorized in your account appear in your installed apps list so that Admins have a complete picture of third-party OAuth access.

User Tokens

When someone authorizes an app, the app obtains a user token that acts on that person's behalf. A user token can only access data the authorizing person can access, further limited by the app's approved scopes. Actions the app takes appear in PagerDuty with that person's attribution — for example, the incident timeline shows that they acknowledged an incident.

📘
App Tokens
In this release, public apps obtain user tokens. App tokens — server-to-server access where the app acts as itself rather than on someone's behalf — remain available only to private apps created by your own account.

Install an OAuth App

Installation begins from the app's installation page. Developers link to this page from their website or documentation. Only Admins and the Account Owner can install apps.

From the developer's site, open the app's installation page. The page lives in your PagerDuty account at https://<your-subdomain>.pagerduty.com/oauth-apps/<APP_ID>.
Review the app's Details — its App ID, Developer, OAuth type, Token types, and Redirect URI — and the scopes the app is requesting.
Click Install on your account. PagerDuty creates the installation and redirects you to the app's management page.

Once the app is installed, anyone in your account can authorize it through the OAuth flow. Installing an app creates an event in your account's audit trail. For more information, visit Audit Trail Reporting.

The OAuth app installation page, showing app details, requested scopes, and the Install on your account button — Install an OAuth app

📘
Not an Admin?
If you open an installation page without Admin permissions, you cannot install the app. Click Copy install link and send the page URL to one of your account Admins so they can install it for you. Once it is installed, you can complete the OAuth flow from the developer's site.

View Installed Apps

To view all the public apps installed on your account, navigate to Integrations OAuth Apps. Each app displays its name, description, and the token types it uses. Admins and non-Admins can both view this list.

The OAuth Apps page listing installed apps with token type badges — Installed OAuth apps

📘
Looking for Private Apps?
Apps your account created are not subject to installation review and do not appear in this list. Click Manage Private Apps on the OAuth Apps page to manage them.

Manage an Installed App

To manage an installed app, navigate to Integrations OAuth Apps and select your desired app.

Admins see the app's details, when it was installed, and a list of everyone who has authorized it, with the date each authorization occurred. Non-Admins see whether they have authorized the app themselves.

The following actions are available from the management page:

Revoke Your User Token (anyone who has authorized the app) — revokes your own authorization. The app can no longer act on your behalf until you authorize it again.
Revoke All User Tokens (Admins and the Account Owner) — revokes every token issued for the app. The revocation runs in the background. Anyone using the app must authorize it again to continue.
Uninstall (Admins and the Account Owner) — revokes all user tokens and removes the app from your installed apps list. The app cannot be authorized again until an Admin installs it.

The OAuth app management page, showing authorizing users and the revocation actions — Manage an installed OAuth app

Authorize an App

Anyone in your account can authorize an installed app to act on their behalf:

Begin on the app's website. The developer explains what PagerDuty data the app requests and provides a call to action to connect PagerDuty.
The app directs you to a PagerDuty authorization screen that lists the scopes the app is requesting. Click Submit Consent.
PagerDuty redirects you back to the app's site, where you can finish configuring it.

⚠️
Installation Required
A public Scoped OAuth app must be installed on your account before you can authorize it. If the app is not installed, ask one of your account Admins to install it first.

FAQ

Why do I see installed apps that nobody installed?

When these pages first become available on your account, apps that were previously authorized in your account are automatically marked as installed — including Classic User OAuth apps. This gives Admins a complete picture of the third-party OAuth access that already exists on the account. Review the list and uninstall any apps you do not want in use.

What happens when I uninstall an app?

Uninstalling revokes all user tokens for the app and removes it from your installed apps list. A public Scoped OAuth app cannot be authorized again until an Admin reinstalls it.

Do private apps need to be installed?

No. Private apps are created by your own account and work without installation. Only public apps — apps built by third parties and approved by PagerDuty to work across accounts — require installation by an Admin.

Can an app gain new scopes without my approval?

No. Access tokens issued to an app are limited to the scopes an Admin approved when installing it. If a developer updates their app to request additional scopes, the app cannot use them until an Admin reviews and approves the change.

Who can install apps?

The Account Owner and Admins can install apps. Without those permissions, the installation page shows a Copy install link button so you can send the page URL to an Admin.