> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Consent

> Learn about the tenant-approval sequence and when the customer's admin must authorize the application.

During the [provisioning][5] of your application, the customer's administrator **must** authorize the application. This is done to secure each customer tenant in the online environment and **it is a requirement**, not optional.

<Note>
  Only a tenant user with administrator rights is allowed to approve online applications, both for standard and custom application types. Specifically, an administrator is someone with **General Administrator** or **User Administrator** function right.
</Note>

The SuperOffice Operation Center stores information about when the application was authorized and which user clicked **I approve**.

The workflow is different for custom and standard applications.

## For custom applications

The SuperOffice App Manager grants explicit consent to approved custom applications [during activation][1].

[1]: ../custom-app/activate

## For standard applications in the App Store

The [tenant administrative user must sign in to SuperID and approve the application][6] to establish an **authorization record** between the application and the tenant. If this option is unavailable to you, a strict hand-shake flow must be implemented.

<h3 id="hand-shake">
  Tenant approval sequence (hand-shake)
</h3>

No one **may** ask for a customer's username and password to gain access to the tenant's resources. Everyone must adhere to the following authorization sequence.

![Authorization sequence -screenshot][img1]

### Post-approval

The user who approved the application appears in the App Store with the date the application was added.

![image5n4c.png -screenshot][img2]

<Note>
  A customer's administrator may authorize the application by clicking a link that includes your client ID. This will show the [consent dialog][6] for the application and as an administrator, they may click **I approve**.
</Note>

## Is consent a one-time action?

No. The application must be approved in [each environment][2].

Some changes will require the customer's administrator to re-approve the application before it gets access to the database after the change.

**Re-approval is mandatory when:**

* your application initially runs in the application [user context][3] and you want to run as the **system user**
* you want to add **Webhooks** to an existing application
* you want to add [database mirroring][4] to an existing application

During approval, the customer's administrator should accept the following change if prompted:

> from: sentry prevents a user from seeing what they should see
> to: full access to everything in a customer database

[2]: ../getting-started/app-envir

[3]: ../getting-started/user-contexts

[4]: ../../online/mirroring/overview

[5]: ./index

[6]: ./get-consent

[img1]: /media/loc/en/developer-portal/appvendorconsultants.png

[img2]: /media/loc/en/developer-portal/installed-apps.png


## Related topics

- [Has Consent](/en/api/reference/restful/rest/person/has-consent.md)
- [Set Consent](/en/api/reference/restful/rest/person/set-consent.md)
- [Remove Consent](/en/api/reference/restful/rest/person/remove-consent.md)