> ## Documentation Index > Fetch the complete documentation index at: https://developers.reintersect.com/llms.txt > Use this file to discover all available pages before exploring further. # Install, consent and reach > How a workspace installs your app, what admins approve, which circles your app can read and write, and what happens when a new version asks for more. > Reintersect apps are in developer preview. Names and limits can still change before general > release. ## Install link Workspace installs start from your app's install link. Register at least one redirect URI in **Settings → Developer → Apps → your app → General** (https, or http on localhost, without a `#fragment`; up to 10), then send admins to: ```text theme={null} https://app.reintersect.com/apps/install ?client_id= &redirect_uri= &state= &code_challenge= &code_challenge_method=S256 ``` The page explains who made the app, lets the admin pick a workspace, and shows the consent screen. After the admin approves, Reintersect redirects to your `redirect_uri` with `code` and `state`; if they cancel, with `error=access_denied` and `state`. The page refuses to load inside a frame. A self-hosted app exchanges the code once, within 10 minutes, for the install id: ```bash theme={null} curl -X POST https://api.reintersect.com/v0/apps/oauth/token \ -H "content-type: application/x-www-form-urlencoded" \ -d grant_type=authorization_code \ -d code="$CODE" \ -d redirect_uri="$REDIRECT_URI" \ -d code_verifier="$VERIFIER" \ -d client_id="$CLIENT_ID" \ -d client_secret="$CLIENT_SECRET" ``` ```json theme={null} { "install_id": "inst_123", "workspace_id": "org_123", "scope": "blocks:write replies:write" } ``` Store the install id with the workspace on your side. There is no long-lived token to keep: when your code needs to call Reintersect outside a delivery, the SDK mints a one-hour install token with your client credentials. See [Install token exchange](/api-reference/install/token) and [Client](/reference/client). A Reintersect-hosted app can ignore the code: the hosted runtime adds install tokens for it. Private apps can only be installed in the workspace that owns them. Members who aren't owners or admins see "Ask an admin to install" instead of the approve button. The app's developer can also pick **Just me** to make a development install in the workspace that owns the app. Installing again replaces the install's settings and moves it to the latest version. ## The consent screen Admins see, in plain language: | Section | What it lists | | - | - | | Workspace data | The scopes the app asks for, such as "Post replies as itself". See [Scopes](/reference/scopes). | | Gets told when | The events it subscribes to. | | Actions | Each block action, marked read-only, makes changes or destructive, and whether agents can use it. | | Adds to Reintersect | Its blocks, references and message actions. | | Outside services | The hosts a hosted app may call, and the MCP server it gives agents. | | Link domains | The domains whose links become your references, each marked verified or not. | | Settings | A form generated from your `installConfig` schema. | ## Reach One rule decides which circles your app can read from and write to: | Install | Circles it reaches | | - | - | | Workspace install | Every public circle, plus each private circle the app was invited to. | | Development install | Only circles its developer is an active member of. | | Any install | Never a circle connected to another workspace or to a Slack channel. | A private circle invites your app when a member: * mentions the app there, * runs one of its [message actions](/message-actions) there, * runs one of its [slash commands](/commands) there, or * places one of its blocks there, from the slash menu, an agent's preview or a paste. The invitation belongs to the install: uninstalling and installing again starts with no invitations. Reach applies to events, writes, block updates and notifications: * Events about posts, replies, decisions, call recaps and links to your objects come only from reachable circles. `app.mentioned` reaches a workspace install in any circle that isn't connected, because the mention itself invites the app. * Writes through the API (`POST /v0/blocks`, `POST /v0/replies`, `POST /v0/streams/events`, a circle memory on `POST /v0/memories`) and answers to commands and message actions land only in reachable circles. Anything else answers as not found, so your app can't tell an unreachable circle from one that doesn't exist. A reply may only mention circles and conversations your app can reach. * Block updates (`PATCH`, `PUT /v0/blocks/…`) only touch blocks your own install created. * Notifications from a development install reach only its developer. Members can still place your blocks in connected circles by hand; peers there see a read-only copy. Your app never acts in those circles on its own, and its commands and message actions don't show there. ## Publishing new versions When you publish a new production version, Reintersect compares what it can access with what each workspace install approved. Access covers: * scopes, outbound hosts, claimed domains and events, * block actions that aren't read-only, and destructive actions, * message actions, and how much context each sends: asking for a message's thread or conversation instead of the message alone is wider access, * the MCP server URL and its tools that aren't read-only or are destructive. | New version's access | What happens to installs | | - | - | | Same or narrower | Every install moves to the new version automatically. | | Wider | The install stays on its current version, shows "Needs review" in **Settings → Workspace → Integrations**, and your app receives `app.reconsentRequired`. Once an admin approves the added access (and fills in any new required settings), the install moves to the new version. | Descriptions, titles and render changes never need review, and neither do slash commands: a command sends your app only what the member picks. Roll back from **Settings → Developer → Apps → your app → Versions**; installs that would need to approve new access stay where they are. ## Uninstalling Admins uninstall from the app's page in **Settings → Workspace → Integrations**. The app loses access at once and receives `app.uninstalled`. Its blocks stay in conversations with their last tree but stop updating, and members can no longer run their actions. ## Names Reintersect reserves Slugs such as `admin`, `api`, `app`, `docs`, `settings`, `support` and `www` (35 in total), and any slug starting with `reintersect`, are refused. App names that start with "Reintersect" or are a role such as "Admin", "Owner", "Security", "Support" or "System" are refused with `reserved-name`. Outbound hosts and domains under `reintersect.com` or `reintersect.app` are refused with `reserved-domain`. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.