---
title: "Managing apps"
description: "Manage external applications as apps in the TYPO3 backend, and compare the app types static token and OAuth."
canonical: index.html
navigation-title: "Administrators"
---

<a id="administration"></a>

<a id="managing-apps"></a>

# Managing apps

You configure external applications as apps in the backend module
Administration \> Integrations \> API Hub. Only administrators
can open it.

- **One list:** all apps, with a filter by name and app type
- **Access:** select the scopes and the backend user of each app
- **Control:** disable an app, or generate a new secret
- **Documentation:** the API of your installation in Swagger UI

[Create an app](creating-apps.md)

[Security and governance](../overview/security.md)

![Illustration of blocks passing through a gate with switches.](../_images/audience-admin.webp)

```diagram
matrix canvas=940 left head="App"
title "Each app has an app type and scopes"
description "A list of four example apps with their app type and their scopes. The content import has a static token and the scopes content:read and content:write. The uptime monitoring has a static token and the scope content:read. The editorial assistant uses OAuth and has the scopes content:read and content:write. The translation service uses OAuth and has the scope content:read."

column "App type"
column "Scopes" weight=2

row "Content import": "Static token" "content:read, content:write"
row "Uptime monitoring": "Static token" "content:read"
row "Editorial assistant": "OAuth" "content:read, content:write"
row "Translation service": "OAuth" "content:read"
```

*Example of four apps with their app type and scopes. In the module API Hub, administrators can edit, disable or delete each app.*

TYPO3 stores apps as records of the table `sys_app` on the root page.

<a id="administration-app-types"></a>

<a id="app-types"></a>

## App types

An app authenticates in one of two ways. The type decides who the app acts
for and how long its credentials are valid.

|  | Static token | OAuth |
| --- | --- | --- |
| **Acts on behalf of** | A fixed backend user | The backend user who approves the access |
| **Access** | The scopes selected in the app record that are available to the backend user | Approved on a consent screen, for the scopes selected in the app record that are available to the backend user |
| **Authentication** | Static bearer token | OAuth 2.0 authorization code flow |
| **Validity** | Does not expire | Access tokens are valid for one hour. Then the app gets a new access token with its refresh token |
| **Meant for** | Scripts and integrations between servers | Applications with several backend users, or applications that must not keep a credential that does not expire |

**[Creating apps](creating-apps.md)**
Create an app with a static token or an OAuth app, step by step.

**[Fields of an app](fields.md)**
What every field of the app record means.