> ## Documentation Index > Fetch the complete documentation index at: https://docs.perflo-api.proofof.tech/llms.txt > Use this file to discover all available pages before exploring further. # Manage connected clients > Understand provider-device authentication, consent, grant controls, logout, and provider disconnect. Perflo uses a server-rendered interaction to authenticate a resource owner, collect consent, and manage each connected client. These pages stay on the issuer origin and never expose upstream provider credentials or identity fields. ## Authenticate through the provider-device interaction When a grant needs human authentication, Perflo displays the verified OAuth client name, requested scopes, and a link to the trusted provider approval site. The link uses `rel="noopener noreferrer"` and a no-referrer policy, so the provider receives no OAuth interaction address or cookie. The browser reads only local interaction status while Perflo checks the provider result server to server. Perflo validates the result and encrypts provider credentials before account binding. Live provider-device adoption is unavailable in this release. Local fake mode exercises the interaction and consent pages, but it does not enable live account binding. ## Narrow consent for one client Consent shows the operator-verified client name and every requested scope. The owner can narrow the scope set but cannot exceed the client’s registered ceiling. The first authorization-code grant always displays consent. `prompt=consent` displays it again, while `prompt=none` fails when stored authentication or consent cannot satisfy the request. Device approval always displays consent. When a grant has an eligible versioned spend policy, the owner can narrow its selectors and limits. A narrowed policy cannot add a service, capability, amount, count, or expiry beyond the registered template. `purchases:execute` is unavailable in this release. Perflo does not advertise, register, consent, or grant that scope, so current owners cannot create a purchase-execution policy. ## Review grants on the account page The host-only page at `/oauth/account` lists only grants owned by the authenticated resource owner. It identifies each client by its verified display name. For each grant, the page can show: * Granted scopes * Effective policy limits and usage when a policy exists * A policy-narrowing action when the policy is eligible * An action that revokes only that client grant One client cannot list, narrow, or revoke another owner’s grant. Revoking one grant immediately invalidates its refresh token and blocks every access token under the live grant check without affecting another client. ## Sign out or disconnect the provider Logout uses the discovered OpenID Connect end-session endpoint and clears the local login session. It does not revoke every client grant. Provider disconnect has a broader effect. Perflo invalidates the login session, revokes every local grant and token for the owner, and records the disconnect request as one atomic action. Provider-side completion can remain pending after the local authorization state is closed. ## Protect every account action Unsafe interaction and account forms require a host-only session cookie with `HttpOnly` and `SameSite=Lax`. Hosted environments also set `Secure`. Every unsafe form requires an exact issuer-origin check and a synchronizer token against cross-site request forgery (CSRF). Grant revocation and provider disconnect require authentication from the previous 10 minutes. Form submissions redirect with Hypertext Transfer Protocol (HTTP) status 303 so a browser never forwards the submitted body to the next address. The account and interaction pages never display or log: * Provider access or refresh tokens * Provider device identifiers * Email or wallet identity * Client assertions, private keys, or Demonstrating Proof of Possession (DPoP) proofs * OAuth authorization, device, or user codes * Session cookies See [Choose an OAuth client profile](/oauth/client-profiles) for supported grants and [Call Perflo from a browser](/oauth/browser-access) for origin rules.