Install, consent and reach

Install link

Workspace installs start from your app’s install link. Register at least one redirect URI in Settings → Developer → Apps → your app → General (https, or http on localhost, without a #fragment; up to 10), then send admins to:

https://app.reintersect.com/apps/install
  ?client_id=<your client id>
  &redirect_uri=<a registered redirect URI>
  &state=<an opaque value you check on return>
  &code_challenge=<PKCE S256 challenge>
  &code_challenge_method=S256

The page explains who made the app, lets the admin pick a workspace, and shows the consent screen. After the admin approves, Reintersect redirects to your redirect_uri with code and state; if they cancel, with error=access_denied and state. The page refuses to load inside a frame. A self-hosted app exchanges the code once, within 10 minutes, for the install id:

curl -X POST https://api.reintersect.com/v0/apps/oauth/token \
  -H "content-type: application/x-www-form-urlencoded" \
  -d grant_type=authorization_code \
  -d code="$CODE" \
  -d redirect_uri="$REDIRECT_URI" \
  -d code_verifier="$VERIFIER" \
  -d client_id="$CLIENT_ID" \
  -d client_secret="$CLIENT_SECRET"

{ "install_id": "inst_123", "workspace_id": "org_123", "scope": "blocks:write replies:write" }

Store the install id with the workspace on your side. There is no long-lived token to keep: when your code needs to call Reintersect outside a delivery, the SDK mints a one-hour install token with your client credentials. See Install token exchange and Client. A Reintersect-hosted app can ignore the code: the hosted runtime adds install tokens for it. Private apps can only be installed in the workspace that owns them. Members who aren’t owners or admins see “Ask an admin to install” instead of the approve button. The app’s developer can also pick Just me to make a development install in the workspace that owns the app. Installing again replaces the install’s settings and moves it to the latest version. Admins see, in plain language:

Section	What it lists
Workspace data	The scopes the app asks for, such as “Post replies as itself”. See Scopes.
Gets told when	The events it subscribes to.
Actions	Each block action, marked read-only, makes changes or destructive, and whether agents can use it.
Adds to Reintersect	Its blocks, references and message actions.
Outside services	The hosts a hosted app may call, and the MCP server it gives agents.
Link domains	The domains whose links become your references, each marked verified or not.
Settings	A form generated from your `installConfig` schema.

Reach

One rule decides which circles your app can read from and write to:

Install	Circles it reaches
Workspace install	Every public circle, plus each private circle the app was invited to.
Development install	Only circles its developer is an active member of.
Any install	Never a circle connected to another workspace or to a Slack channel.

A private circle invites your app when a member:

mentions the app there,
runs one of its message actions there,
runs one of its slash commands there, or
places one of its blocks there, from the slash menu, an agent’s preview or a paste.

The invitation belongs to the install: uninstalling and installing again starts with no invitations. Reach applies to events, writes, block updates and notifications:

Events about posts, replies, decisions, call recaps and links to your objects come only from reachable circles. app.mentioned reaches a workspace install in any circle that isn’t connected, because the mention itself invites the app.
Writes through the API (POST /v0/blocks, POST /v0/replies, POST /v0/streams/events, a circle memory on POST /v0/memories) and answers to commands and message actions land only in reachable circles. Anything else answers as not found, so your app can’t tell an unreachable circle from one that doesn’t exist. A reply may only mention circles and conversations your app can reach.
Block updates (PATCH, PUT /v0/blocks/…) only touch blocks your own install created.
Notifications from a development install reach only its developer.

Members can still place your blocks in connected circles by hand; peers there see a read-only copy. Your app never acts in those circles on its own, and its commands and message actions don’t show there.

Publishing new versions

When you publish a new production version, Reintersect compares what it can access with what each workspace install approved. Access covers:

scopes, outbound hosts, claimed domains and events,
block actions that aren’t read-only, and destructive actions,
message actions, and how much context each sends: asking for a message’s thread or conversation instead of the message alone is wider access,
the MCP server URL and its tools that aren’t read-only or are destructive.

New version’s access	What happens to installs
Same or narrower	Every install moves to the new version automatically.
Wider	The install stays on its current version, shows “Needs review” in Settings → Workspace → Integrations, and your app receives `app.reconsentRequired`. Once an admin approves the added access (and fills in any new required settings), the install moves to the new version.

Descriptions, titles and render changes never need review, and neither do slash commands: a command sends your app only what the member picks. Roll back from Settings → Developer → Apps → your app → Versions; installs that would need to approve new access stay where they are.

Uninstalling

Admins uninstall from the app’s page in Settings → Workspace → Integrations. The app loses access at once and receives app.uninstalled. Its blocks stay in conversations with their last tree but stop updating, and members can no longer run their actions.

Names Reintersect reserves

Slugs such as admin, api, app, docs, settings, support and www (35 in total), and any slug starting with reintersect, are refused. App names that start with “Reintersect” or are a role such as “Admin”, “Owner”, “Security”, “Support” or “System” are refused with reserved-name. Outbound hosts and domains under reintersect.com or reintersect.app are refused with reserved-domain.

Get started

Concepts

Blocks

Chat

References

Events and delivery

Search and agents

MCP

Ship

Install link

Reach

Publishing new versions

Uninstalling

Names Reintersect reserves

​Install link

​The consent screen

​Reach

​Publishing new versions

​Uninstalling

​Names Reintersect reserves

Install link

The consent screen

Reach

Publishing new versions

Uninstalling

Names Reintersect reserves