Permissions & Grants

Before one app can call another, you need to grant it access. All of these settings are on each app's Settings → Cross-App tab. Your coding agent can change them over MCP too: create_cross_app_grant and revoke_cross_app_grant for grants, and update_cross_app_settings for the switches below, which shows you a preview first.

Allow all apps to call this projectCopy Anchor Link

The quickest option. Turn on Allow all apps to call this project in the app's Settings → Cross-App tab. Any app in the organization can then call this project's API without a specific grant.

Good for:

• Data services that any app might need (product catalog, pricing, configuration)
• Quick development and testing
• Apps that share data openly within the org

Explicit grantsCopy Anchor Link

For more control, grant one app access to another. A grant has two parts:

• Which app can call this one
• What it can do: Read only (GET requests) or Full access (GET, POST, PUT, PATCH, and DELETE)

Grants are created from the calling app. Its Settings → Cross-App tab has an Outgoing calls section. The target app's Incoming calls section lists the grants that point at it, but you can't add one from there.

Managing GrantsCopy Anchor Link

Adding a GrantCopy Anchor Link

1. Open the calling app and go to Settings → Cross-App
2. Under Outgoing calls, select the app you want to call
3. Choose Read only or Full access
4. Click Add

Changing or Removing a GrantCopy Anchor Link

Use the access level menu on a grant to change it. Click the delete button next to any grant to remove it. Access is revoked immediately.

create_cross_app_grant takes a list of HTTP methods instead of an access level, so a grant your agent made can allow, for example, GET and POST only.

Recent callsCopy Anchor Link

The Recent calls section on the Cross-App tab lists recent cross-app calls. Each entry shows the time, the method and path called, the environment that answered, the status, and the duration.

This is useful for debugging when a cross-app integration isn't working as expected.

SettingsCopy Anchor Link

Allow all endpointsCopy Anchor Link

Lets cross-app callers reach any API route. When it's off, only endpoints with a documented schema are callable. Off by default.

Allow agent accessCopy Anchor Link

Lets your organization's agents operate this app directly, reading and writing through its API on your behalf, independent of app-to-app grants. That covers Starcat and your coding agent connected over MCP. Off by default.

When it's on, you also choose which of this app's environments the agent may call (Production, Preview, Sandbox). See Agent Cross-App Calling for how the agent picks an environment and what it can do.

Environment routingCopy Anchor Link

Sets which deployment answers incoming cross-app calls from each caller environment. Each of the Sandbox caller, Production caller, and Preview caller rows takes one of these:

• Same environment (the default): the call goes to the environment it came from
• Sandbox, Production, or Preview: the call goes to that environment instead
• Block: calls from that caller environment are refused

Developer-agent callable environmentsCopy Anchor Link

Controls which of this app's environments Starcat Developer, in the app's Build tab, may make cross-app calls from. Check Sandbox, Production, or both. At least one stays checked. Both is the default.

This is the outbound counterpart to Allow agent access above, which controls what agents may call into this app. It doesn't affect your coding agent.

NextCopy Anchor Link

Agent Cross-App Calling

Call your apps' APIs from your coding agent or Starcat