It is easy to click Allow Access without reading it. The screen is worth ninety seconds.

Plenty of Jobber integrations are useful and well built. This is about reading the screen, not distrusting vendors.

What the approval screen shows

A developer picks their app’s scopes when they register it in Jobber’s Developer Center. Scopes “define exactly what data your app can read or write” and “are displayed to users on the OAuth authorization page”.² That page is the screen in front of you.

The example in Jobber’s documentation collapses the request into headings, each with a chevron: company information and admin settings, team member information, Jobber workflow information, financial information, vehicle and equipment information.¹ Open every one that appears on yours.

Two more lines matter. Jobber warns you may be sharing sensitive info and allowing changes in your account, and notes that the app’s use of your data is subject to its own privacy policy.¹ If the app has not been through Jobber’s approval process, the screen says so in red.¹ That is not an accusation, since integrations built for one company legitimately skip review.⁶ It means nobody at Jobber has looked.

Read access and write access are different things

Jobber’s API has two kinds of operation. Queries read data, mutations write it.³ That is why the summary line says view or edit, and why the real distinction sits inside the groups you expand.

An app with read access can copy. An app with write access can change a client record, a quote or an invoice. If a vendor’s product is a report, it has no reason to ask for edit access. Jobber applies the same test: apps “will be rejected if their apps exceed the scope of their need”.³

Access asked for just in case

“We ask for a little extra so we don’t have to come back and bother you” sounds considerate. Jobber has already made coming back cheap: adding scopes later forces existing users to re-authorize, through a banner you have to allow.³⁴ A vendor who wants to skip that step is asking you to approve a use they have not described.

There is a catch in the other direction. If a developer removes scopes, existing tokens keep the old ones, and Jobber advises disconnecting and reconnecting.⁴ A vendor narrowing what they read does not narrow your connection until you reconnect.

What read access does and does not allow

With read access to clients, quotes, invoices and payments, a third party can pull your customer list with names, addresses, phone numbers and emails, see what you quoted and at what price, and see which invoices are unpaid. Access tokens last 60 minutes, but the app holds a refresh token that mints new ones without asking again.¹ Read access is not an export. It is a standing subscription to your book of business.

With read access alone, a vendor cannot change anything in your account. One gap the screen does not close: most vendors that email or text your customers send from their own system, not through Jobber. That is not a Jobber permission, so no group on the screen describes it. You have to ask.

The question to ask the vendor

One sentence, and get the answer in writing.

“Nothing goes out, we only show you things” is the narrowest answer. “You approve each one” is workable; ask to see that step. “Things go out automatically” is a decision, not a setting. Then ask four more:

• What do you read from my account, in plain terms.
• What do you store on your side, and where.
• How long do you keep it after I disconnect.
• Do you ever contact my customers, on any channel, in my name.

A developer who has thought about this answers in a paragraph. One who has not sends a privacy policy that never mentions Jobber.

Where you turn it off, and what that does

Apps in the side navigation opens the App Marketplace, and only admin users can reach it. Open the app, click Disconnect, confirm.⁵ A Connected Apps section also appears in Settings once an app is connected.⁵

All access and refresh tokens are invalidated immediately, and the app must delete its stored tokens for your account and mark the connection inactive, which Jobber verifies before approving an app.¹ An app that queries anyway gets an error telling the developer to delete the token.⁷

Disconnecting stops future access. It does not delete the copy the vendor already holds, so ask for that separately, in writing. And if the person who connected the app is later deactivated, the apps they set up go too.⁵

The customer list is the part to protect

For a plumbing, electrical, HVAC, landscaping or cleaning company, that list is names, service addresses, phone numbers and payment history. Keep the count of admin users small, since only admins can connect apps.⁵

The rules on sending to it are not vague. Commercial email needs a valid physical postal address and a working opt-out, and the opt-out has to be honoured within 10 business days. And on vendors: “even if you hire another company to handle your email marketing, you can’t contract away your legal responsibility to comply with the law.” Both the promoted company and the sender can be held responsible, at up to $53,088 per email.⁸

Connecting an app is reversible in three clicks, and Jobber kills the tokens the moment you confirm. An email that went to nine hundred past customers under your name is not reversible by anything.

Where we come into it

We build an integration that connects to Jobber, so run this checklist on us. Ask what we read, what we store, how long we keep it, and whether anything goes out under your name. If the answers are vague, do not connect us.

None of this needs us. The screen is in your account and so is the disconnect button. We would rather you asked everyone, us included, than got into the habit of clicking Allow Access.