Provider permissions and scopes

Connecting a tool means trusting Laya with some access to it. This article sets out plainly what Laya connects with, what it does with that access, and how to take it away — from either side.

How each tool connects

Laya only ever acts with credentials you explicitly grant or create — it has no more access than the account or token you gave it.

Whatever the method, Laya uses the access for one job: mirroring the boards you choose and pushing back the edits you make in Laya.

What Laya does with the access

• Imports and stores a mirror of the boards you choose to connect — a durable, synced copy of each item's core fields (title, status, assignees, dates and links) that powers connected boards and two-way sync.
• Pushes your Laya edits back to the provider.
• Reads and posts comments live from connected-board panels using the provider's own APIs — so the provider's own permissions still apply.
• Stores your credentials encrypted at rest (AES-256-GCM) and never returns them via the API or shows them again in the app.

What Laya does not do

• It does not mirror boards you have not chosen to connect.
• It does not keep a board's mirror after you disconnect it — the mirror is deleted.
• It does not sell your data or use your content to train AI models.

Revoking access in Laya

Use Disconnect on the connection's page under the workspace settings — for Jira, that is Settings → Jira. Only the workspace Owner or an Admin can disconnect, and disconnecting a shared team connection warns you before stopping sync for everyone.

Disconnecting removes the connection, its mirrored boards and their cached items. Native Laya boards and the items you imported survive as ordinary Laya items — see Disconnecting safely for details per provider.

Revoking access on the provider side

You can also cut access from the provider itself — useful if you no longer have access to the Laya workspace, or simply want certainty. The exact menus vary by provider, but each credential is revoked where it was created:

• Jira — delete the API token in your Atlassian account settings, remove Laya from your Atlassian account's authorised apps (OAuth), or uninstall the Laya Board for Jira app from the site.
• Azure DevOps — revoke the personal access token in your Azure DevOps user settings, or remove Laya's authorisation from your Microsoft account (Entra OAuth).
• monday.com — regenerate or revoke the API token in your monday.com account settings.
• GitHub — delete the personal access token in your GitHub developer settings, or, if you connected with Continue with GitHub, revoke Laya's OAuth authorisation from your GitHub account's authorised apps.
• GitLab — revoke the personal access token in your GitLab access token settings, or, if you connected with Continue with GitLab, revoke Laya's OAuth authorisation from your GitLab account's applications.