Connected apps control which external systems and AI tools can access your Legatics environment. This guide walks you through creating a connected app, configuring its permissions, and managing it over time.
Prerequisites: You need to be a System admin to create and manage connected apps.
Creating a connected app
In the Administration System, go to Integrations > Connected apps
Click Create connected app
Enter a Name for the app. Use something descriptive that identifies the integration (for example, "Legal AI tool" or "Internal reporting dashboard")
Optionally, add a Description to help other admins understand what the app is used for
Choose an Authentication type. Keep the default unless the AI tool or integration you're connecting to Legatics requires a public client (see below)
Enter the redirect URL(s) from the system you are connecting to. At least one is required, and Legatics enforces an exact match against the URL the system sends
Select the scopes you want to grant. Only select the scopes the integration requires
Click Create application
Important: The legatics_mcp scope is always required for an integration to use the MCP server.
Choosing an authentication type: Most integrations use the default type, which authenticates with a client ID and a client secret. Some AI tools and integrations can't store a client secret, so they connect as a public client instead. Choose Public client only if the provider of the tool you're connecting says it's required. Their setup documentation may describe this as "PKCE with no client secret". If you're not sure, check with your IT/developer or the tool's provider. A public client receives a client ID only.
Note: If you wish the integration to be restricted to read only in Legatics, add the read_only scope. This keeps the app read-only regardless of what other scopes it has.
Your connected app is created. Legatics generates a client ID for the app and, unless you chose Public client, a client secret.
Important: The client secret is only shown once. Copy it and store it securely before closing the screen. If you lose it, you'll need to generate a new one.
Sharing credentials with the integration
Once the connected app is created, you need to provide the credentials to the person configuring the system or tool you're connecting. This is usually your IT/developer or AI tool admin. Members don't need the client ID or client secret: they only sign in with their own Legatics credentials.
Credential | What it is |
Client ID | A unique identifier for your connected app. Safe to share with the integration. |
Client secret | A private key used to authenticate the app. Treat this like a password. Only share it with the person configuring the integration, and never with members or publicly. Not issued for public clients. |
Some integrations will also ask for your MCP URL and API base URL. These aren't generated per connected app, so you won't find them on this screen. They follow a fixed structure based on your Legatics instance:
| Example |
MCP URL |
|
API base URL |
|
Replace eu1 with your own instance code. If your integration doesn't connect using this pattern, contact your Legatics account team to confirm the correct URL for your instance.
You will need to refer to the documentation for the system you're connecting to understand exactly where to enter these credentials.
Tip: For AI tools, configuration is usually handled by your IT/developer or AI tool admin.
Configuring a connected app
Once created, you can update a connected app's settings at any time.
Editing the name or description
Go to Integrations > Connected apps and select the app you want to edit
Update the Name or Description field
Press Save
Updating scopes
Go to Integrations > Connected apps and select the app you want to edit
Update the Scopes selection - add or remove scopes as needed
Press Save
Note: If you remove a scope that the integration is currently using, that integration will lose access to that data immediately. Check with the IT/developer or AI tool admin who manages the integration before removing scopes.
The reverse is also true. Granting new scopes — including giving a previously read-only app the ability to write — takes effect immediately for everyone using that app, not just the person who updated it.
Important: Connected apps created before write access went live don't gain write capability automatically. To let an existing app write to Legatics, update its scopes.
Regenerating the client secret
If your client secret is compromised or lost, you can generate a new one.
Go to Integrations > Connected apps and select the app
Open the context menu and click Regenerate secret
In the confirmation that appears, press Regenerate
Important: Generating a new secret immediately invalidates the old one. The connected integration will stop working until you update it with the new secret.
Enabling and disabling a connected app
Enabling
Connected apps are active by default when created. If you've previously disabled an app and want to re-enable it, press the Enable toggle at the top of the app screen.
Disabling
To temporarily prevent an integration from accessing Legatics without deleting it:
Go to Integrations > Connected apps and select the app
Press the Enable toggle to turn it off
When disabled, the connected app's tokens are invalidated. The integration will not be able to authenticate until the app is re-enabled.
Deleting a connected app
Important: Deleting a connected app immediately and permanently revokes all access for that integration. This cannot be undone.
Go to Integrations > Connected apps and select the app you want to delete
Press Delete app at the bottom of the page
In the confirmation that appears, press Delete
Tip: If you want to temporarily stop an integration from accessing Legatics, disable the app rather than deleting it.
Next step: Finding your Legatics API and MCP URLs