> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wiseguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in and permissions

> How your AI app signs in to WiseGuard, what you approve, and how to disconnect it.

## How sign-in works

The connector uses OAuth. You never give your password or an API key to your AI app.

1. You add the connector in your AI app. See the [Quickstart](/quickstart).
2. The app opens the WiseGuard sign-in page. Sign in with your WiseGuard account. New users go through checkout first.
3. WiseGuard shows a consent page. It names the app and what it's asking to do: manage your aliases, read your mail, and send mail as your aliases.
4. You approve. The app gets an access token that only works with the WiseGuard connector.

Only apps WiseGuard has registered in advance can sign in. Today that's Claude and Claude Code.

## What you approve

The connector has four scopes. Each tool checks for its scope before it runs.

| Scope | Lets the app | Tools |
| - | - | - |
| `aliases:read` | See your aliases and your recently deleted aliases. | `wiseguard_list_aliases`, `wiseguard_get_alias`, `wiseguard_list_recently_deleted` |
| `aliases:write` | Create, rename, pause, resume, delete and restore aliases. | `wiseguard_create_alias`, `wiseguard_rename_alias`, `wiseguard_pause_alias`, `wiseguard_resume_alias`, `wiseguard_delete_alias`, `wiseguard_restore_alias` |
| `mail:read` | Read the emails your aliases receive, and mark them as read. | `wiseguard_list_messages`, `wiseguard_read_message` |
| `mail:send` | Send email from your aliases: replies and new emails. | `wiseguard_reply_as_alias`, `wiseguard_compose_as_alias` |

`wiseguard_whoami` needs no scope. Any connected app can call it.

With `mail:read` and `mail:send`, your agent can read the mail your aliases receive and send email as your aliases. See [Security and privacy](/guides/security-and-privacy#email-content-is-untrusted) for how that's kept safe.

If the app calls a tool without the right scope, it gets a `403` with `insufficient_scope`. Reconnect and approve access to fix it.

If you connected before the mail tools existed, your approval only covers aliases. The mail tools then get `insufficient_scope`. Remove the connector in the app, add it again, and approve the new access.

## Plan requirement

You need a WiseGuard account to connect. New accounts go through checkout first, and a trial counts.

Looking at your aliases and reading your mail is free. Changing aliases and sending email cost [AI agent credits](/guides/credits). Credits come with a paid plan. Trials don't include them, so on a trial your agent can look but can't make changes.

Creating an alias also needs an active plan. If your account goes read-only, for example after a failed payment, the agent can't create aliases. It can still make other changes with the credits you have left. When your plan ends, your credits [expire](/guides/credits#when-credits-expire). [`wiseguard_whoami`](/tools/account) tells your agent whether you can create aliases right now (`canCreate`), and how many credits you have left.

## Disconnect and reconnect

To stop an app from using your account:

1. In WiseGuard, open **Settings → AI agents**, choose the app and click **Disconnect**.
2. Also remove the connector inside the AI app:
   * **Claude:** open **Settings → Connectors** and remove WiseGuard.
   * **Claude Code:** run `claude mcp remove wiseguard`.

Disconnecting in WiseGuard blocks the app right away. From then on, every request it makes gets a `403` with this message:

```text wrap theme={null}
This app was disconnected from your WiseGuard account. Reconnect it in WiseGuard under Settings → AI agents.
```

The app gets this with HTTP status `403` and error `access_denied`.

To let the app back in, open **Settings → AI agents** in WiseGuard and click **Reconnect**. It works right away. If you also removed the connector in the app, add it again with the [Quickstart](/quickstart) steps.

## What can go wrong

* **Sign-in loops or fails.** Remove the connector in the app and add it again.
* **The app says it was disconnected.** Reconnect it in **Settings → AI agents**.
* **Creating an alias fails with a plan error.** Your plan is inactive. See [Troubleshooting](/guides/troubleshooting#inactive-plan).
* **A change fails with a credits error.** You're out of credits, or on a trial. See [Troubleshooting](/guides/troubleshooting#not-enough-credits).
* **The mail tools fail with `insufficient_scope`.** You connected before they existed. Remove the connector and add it again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.