How to Revoke Third-Party App Access to Google

Every time you tap “Sign in with Google” on a new app, you hand that developer a key to part of your Google Account. Most of those keys are still active years later, attached to apps you have forgotten, from services that may have changed hands or shut down. Google keeps the full list in one place, and reviewing it takes about five minutes.

This is an evergreen task rather than a news story, but it is worth doing now: the same list that shows a photo editor from 2021 also shows anything that gained access last week without you noticing.

What a linked app actually is

Google’s own help pages describe linked apps as apps from developers other than Google that you have given some access to your account data. Depending on what you approved, that access can include Gmail, Drive, Calendar, Photos and Contacts.

Two points from Google’s documentation are worth keeping in mind. First, linked apps can only reach the data and services you authorised, so an app granted Calendar access cannot read your Photos. Second, Google tells users never to give a third-party app their Google password, because an app with your password has full access rather than limited access. The whole point of the linked-app system is to avoid that.

Step one: open the list

Go to myaccount.google.com/connections and sign in. The same page is reachable from your Google Account’s Security section and from Data & privacy; Google has renamed these screens more than once, so if the menu label differs on your account, search your account settings for “third-party apps” and you will land in the right place.

You will see the apps with some level of access to your account, grouped by what they can reach. On a phone, the list is in the Google app under your account, or in a browser at the same address.

A person holding and using a smartphone with both hands — The connections screen works in a phone browser too. Photo: Santeri Viinamäki, CC BY-SA 4.0, via Wikimedia Commons.

Step two: judge each app

Work down the list and ask three questions for each entry:

Do I still use it? An app you stopped using last year does not need live access.
Does the access match the job? A wallpaper app that can read your Gmail is a mismatch, regardless of how reputable it looks.
Would I recognise the developer? If you cannot remember granting access and the name means nothing, treat it as unknown until proven otherwise.

Google also offers time-limited access on some links, so an app can be told to keep access for a set period rather than indefinitely. If you are trying something new and are not sure about it, that is the safer setting.

Step three: revoke what you do not need

Select the app to see what it can access, then remove the connection. Depending on the app type, the option is labelled along the lines of deleting all connections with that app, or stopping it from using Sign in with Google. Google’s help page confirms you can remove access at any time, and that deleting your linked-app account does not delete your Google Account.

Revocation takes effect for future access. It is not a time machine.

What revocation does not do

This is the part most guides skip. Cutting access stops the app from reading new data. It does not recall anything the app already copied, exported or stored on its own servers, and it does not change your Google password. If an app had access to your Gmail for two years, the mail it archived is still wherever the developer put it.

So revocation is step one of a cleanup, not the whole cleanup.

Step four: close the follow-on risks

Change your Google password if the app you revoked was untrusted, or if you ever typed your Google password into it. Do this from a device you trust, then sign out other sessions.
Check app passwords and device sign-ins. Older apps and some devices use a generated app password instead of OAuth. Google stopped supporting username-and-password sign-in for less secure apps on Workspace accounts from January 2025, but existing app passwords can still be live. Review and revoke any you do not recognise.
Run Security Checkup. Google’s own review walks through recent security events, connected devices and recovery details in one pass, and it flags things a manual audit will miss.
Turn on two-step verification if it is off, and prefer a passkey or security key over SMS where your account supports it.

Make it a habit, not a project

Quarterly is enough for most people, and the trigger points matter more than the calendar: after you try a new AI tool, after a service you used announces a breach, and after any app asks you to re-authorise. That last one is the useful signal, because a re-authorisation request often means permissions changed.

The same suspicion is worth applying to browser add-ons, which can read page content directly rather than through an API. Our guide to checking a browser extension before you install it covers the permissions that should make you stop.

What we did not do

We did not test these steps on a live account for this article, and we have not audited any specific third-party app. The permission model, the “never share your password” warning and the time-limited access option come from Google’s own help documentation, linked below. Menu labels differ by account type, region and Google’s own redesigns, so follow what you see on screen rather than treating any label here as exact.