Managing Which Apps Can Touch Your Site
Connections in website-builder work like the 'connected apps' page you already know from Google or GitHub — a list of what has access, and a revoke button that actually cuts it off.
You've almost certainly used a "connected apps" or "authorized applications" settings page before — Google has one, GitHub has one, Slack has one. It's become such a normal expectation for any platform that grants third-party access that its absence is itself a warning sign: if a platform lets things connect to your account but gives you no list of what's connected and no way to cut one off, that's worth noticing.
Website-builder has this page, under Connections, and it's worth understanding what it actually controls.
What a connection is
Every OAuth grant to a third-party client or MCP client — including an AI assistant like Claude or ChatGPT connected through MCP — shows up here as a connection. Each one carries a client name, the scope it was granted (what it's allowed to do), and a last_used_at timestamp, so you can see not just that something is connected but when it last actually did anything.
Why revocation goes through identity-worker, not a local flag
The connections list doesn't query grants directly from wherever a given client happens to store its session — it reads from and revokes through identity-worker, the platform's shared identity service. That's a deliberate design choice: a single grant can back multiple tokens (a client might refresh its access token several times over the life of one authorization), and if revocation only killed the most recent token, a client with an older cached token could keep working after you thought you'd cut it off. Routing revocation through identity-worker means one click cascades to every token issued under that grant, not just the newest one.
What to actually do with this page
Check it the way you'd check any connected-apps list: periodically, and specifically after you finish a project with an agency, stop using a particular AI assistant, or notice a last_used_at that's more recent than you expected for a client you don't remember authorizing recently. A connection you don't recognize, or one you recognize but no longer need, costs nothing to revoke and costs you real exposure to leave sitting there unused.
The existence of this page isn't a headline feature — it's table stakes. But it's table stakes worth confirming is actually there before you connect anything with write access to your site, and it is.