Nearly every time someone clicks “Sign in with Google,” a small permission handshake happens in the background. A third-party app gets a token that lets it read a slice of your account, and that token can stay active for years. Google’s own account dashboard can list dozens of these connections, and most people have never opened that list once. The result is a quiet accumulation of apps holding access to email, contacts, calendar, or cloud files long after the user stopped caring about them.
This guide walks through where that list lives, how to read it, what revoking access actually does, and the mistakes people make when they confuse account-level permissions with on-device permissions. It is written for anyone who wants a clear, practical answer rather than a vague warning to “review your settings.”
What “app access” really means
When an app asks to connect to a Google Account, it does not get your password. Instead, it receives an OAuth token, a scoped credential that grants specific permissions. Those permissions are called scopes. A weather app might request only basic profile info, while a scheduling tool might request full calendar read and write access.
There are two broad categories worth separating:
| Type of access | Where it is managed | What it controls |
|---|---|---|
| Account-level (OAuth) access | Google Account settings | What a third-party app can read or change in your Google data |
| Device-level permissions | Android or iOS settings | What an installed app can access on the phone itself, such as camera, location, or microphone |
These two systems are independent. Revoking an app’s Google Account access does not uninstall it, and uninstalling an app does not always revoke the token it received. That gap is where a lot of confusion lives, and it is the single most common oversight in account hygiene.
Step one: open the third-party connections page
The main hub is Google’s Third-party apps & services page, reachable from the account settings area. Google has renamed this page more than once over the years, so the label you see may read “Apps with account access” or something similar depending on when you look. The underlying function is the same: it lists every app and service that has been granted access to your account.
A reliable path that survives most redesigns:
- Go to your Google Account by clicking your profile picture in any Google service.
- Select Security in the left navigation.
- Scroll to the section covering third-party access and open it.
- Review the list of connected apps.
You can also reach the same list by searching your account settings for “third-party apps.” If you are already signed in, the account dashboard will take you straight there.
Reading the list properly
Each entry usually shows the app’s name, the developer, an icon, and a summary of what it can access. Some entries include a “last accessed” indicator, though coverage of that detail varies. Do not assume an app is harmless because it is unfamiliar, and do not assume it is dangerous because you do not recognize the name. Many legitimate services connect through Google and never send an email afterward.
A sensible triage order:
- Unknown names. Anything you cannot place at all deserves a closer look.
- Old apps. Services you stopped using but never disconnected.
- Broad scopes. Apps with access to Gmail, Drive, or Contacts carry more risk than apps limited to basic profile data.
- Duplicate tools. Three different note-taking apps with Drive access is a sign of clutter, not necessity.
Step two: run Google Security Checkup
Google’s Security Checkup is a guided review that surfaces several account health items, and third-party access is typically one of them. It is worth running because it catches things a single settings page might not highlight, including recent security events and recovery information that has gone stale.
The checkup is also useful as a periodic habit rather than a one-time task. A quarterly pass takes a few minutes and keeps the connection list from ballooning. People who connect apps for work trials or side projects tend to accumulate tokens fastest, and those are exactly the ones nobody remembers.
Step three: revoke what you do not need
Removing access is usually a single action per app. The button may read Remove access or Delete all connections, and some pages offer a bulk option to disconnect everything at once. Bulk removal is tempting but blunt; it will sign you out of services you actually rely on.
Here is what revocation does and does not do:
- It stops the app from making new requests to your Google data.
- It does not delete data the app already collected and stored on its own servers.
- It may break the app’s functionality, including signing you out entirely.
- It does not uninstall the app from your phone.
That second point matters more than people expect. If a calendar app already synced a year of events, revoking access stops future syncing but leaves the copied data where it is. For apps you genuinely distrust, revocation should be paired with a request to the developer to delete stored data, or with a check of that app’s own privacy settings.
The “Sign in with Google” trap
Many apps use Google sign-in purely as an authentication method, not to read your data. Removing access to one of these will lock you out of the app until you sign in again by another route, or it may lock you out permanently if no password exists. Before revoking, ask a simple question: does this app hold anything I would miss? If the answer is yes, check whether it offers a password or recovery option first.
Step four: check device permissions separately
Account access is only half the picture. On Android, installed apps request permissions that live entirely on the device. These are managed in Settings, typically under Apps, then Special app access or a Permission manager view. On iOS, the equivalent lives under Settings, then Privacy & Security.
This distinction trips up almost everyone. A photo editor with no Google Account connection can still have full access to your photo library through a device permission. Conversely, an app with broad Google Account scopes might have zero device permissions. Auditing one without the other gives a false sense of security.
For anyone who installs apps from outside official stores, this audit matters even more. Sideloaded packages can request unusual combinations of permissions, and learning how to check whether an APK file is safe before installation is a far better defense than cleaning up afterward.
Common mistakes that undermine the audit
A few patterns show up again and again when people try to tidy up their connected apps.
Mistake one: revoking everything in a panic. Bulk removal breaks workflows and often gets reversed within a week, which means the audit accomplishes nothing lasting. Targeted removal beats scorched earth.
Mistake two: assuming two-factor authentication covers third-party apps. Strong 2FA protects your login, not the tokens already issued. An app with a valid token does not need your password or your second factor. This is precisely why token review is a separate discipline from password hygiene, and why comparing tools like Authy vs Google Authenticator only solves part of the problem.
Mistake three: ignoring the scopes. An app that can read all your email is a different risk class from one that reads your display name. Skim the permission summary rather than the app name alone.
Mistake four: never revisiting. Connections added during a free trial in one year can persist into the next. A recurring calendar reminder is genuinely effective here.
Mistake five: confusing browser extensions with connected apps. Extensions that request Google access do appear in some lists, but their behavior is governed by browser permissions too. Check both places.
How to build a routine that sticks
The most practical approach is a light, regular habit rather than an annual deep clean. A quarterly review of five minutes covers most people’s needs:
- Open the third-party connections page.
- Sort mentally by risk: unknown apps first, broad scopes second.
- Revoke anything unused for a year or more.
- Run Security Checkup.
- Glance at device permissions for anything newly installed.
For students juggling note apps, citation managers, and study planners, the list grows fast. Anyone assembling a toolkit should treat permission review as part of the setup, not an afterthought, which is why guides on the best apps for students are more useful when they mention what each app actually requests.
It also helps to understand the broader trend. Cloud providers have spent years tightening default permissions and pushing toward shorter-lived credentials, a shift visible in the rivalry between AWS vs Azure vs Google Cloud in 2026. Consumer accounts are following the same path, slowly. Google has already retired older, weaker access methods for third-party email clients, forcing apps toward modern, scoped authentication. The direction is clear: fewer standing permissions, more just-in-time ones.
What about exporting your data first?
Before making sweeping changes, some people prefer a record of what was connected. Google Takeout can export account data, and connection information may appear among the available categories, though the exact labeling shifts over time. An export is not a backup of the app’s behavior, but it does give you a dated snapshot you can compare against later.
This step is optional. For most users, a simple screenshot of the connections list serves the same purpose and takes ten seconds.
When an unfamiliar app appears
Finding an app you do not recognize is unsettling, but it is rarely an emergency. Work through it calmly: (OAuth)
- Check whether the name matches a service you signed into with Google and forgot about.
- Look at the scopes. Profile-only access is low risk; Gmail access is not.
- Search your email for the app’s name to find the original welcome message, which usually dates the connection.
- If it still means nothing, revoke access and change your Google password as a precaution.
- Review recent account activity for anything unexpected.
Most mystery entries turn out to be forgotten trials, old workplace tools, or apps connected through a single tap on a phone setup screen. Genuine unauthorized access usually leaves other traces, such as unfamiliar sign-in locations or changed recovery settings.
Conclusion
Checking which apps can reach your Google Account is not complicated, but it is easy to postpone indefinitely. The list lives in your account’s security settings, it shows what each app can access, and removing an entry takes seconds. The real work is the discipline around it: separating account-level tokens from device permissions, reading scopes instead of just names, and accepting that revocation stops future access without erasing what has already been collected.
A short quarterly review, paired with Security Checkup and a glance at device permissions, keeps the list honest. The apps that genuinely earn their place will survive the audit. The ones that quietly accumulated will not, and that is exactly the point.
Frequently asked questions
Does removing an app’s access delete the data it already collected?
No. Revoking access stops the app from making new requests to your Google Account, but any information it already copied to its own servers stays there. To remove stored data, you need to use that app’s own deletion tools or contact the developer directly.
Will revoking access uninstall the app from my phone?
No. Account access and installation are separate. Revoking the token disconnects the app from your Google data, but the app remains installed until you uninstall it. You should also check its device permissions separately.
Why do some apps disappear from the list on their own?
Tokens can expire, be invalidated by the developer, or be revoked automatically when a service shuts down. Google has also retired older access methods over time, which removed some connections without any action from users.
Is it safe to use “Sign in with Google” for new apps?
Generally yes, and it is often safer than creating yet another password, because Google controls the authentication flow. The caveat is scope: check what the app requests before approving, and prefer apps that ask for the minimum.
How often should I review connected apps?
A quarterly check works well for most people. Anyone who frequently trials new tools, installs apps from outside official stores, or shares a device should review more often, perhaps monthly.
What should I do if I find an app I never authorized?
Revoke its access immediately, then change your Google password and review recent account activity for unfamiliar sign-ins. Also check your recovery email and phone number to confirm nobody has altered them.
