Approving outside services
An app on Haechy can't reach anything on the internet until a person approves it. When your app needs an outside service, Claude asks for it and gives a reason. You, or an admin of your workspace, approve or deny it from a link in the Haechy console. Claude can't approve for you.
What the approval page shows
Claude asks with the request_outbound_access tool: a host name (such as api.example.com, or *.example.com for every name under a domain), an optional port (443 unless it says otherwise) and a reason of 5 to 500 characters. The reason is written for you, the person deciding. Haechy replies with a one-time link.
The page behind that link shows the app, the host and port, the reason, who asked (Claude, or Haechy's deploy check), when, and the files where the app's code mentions the host. Then two buttons: approve or deny.
Expense tracker wants to connect to api.
Your app, on Haechy
Expense tracker
expenses-
Outside service it would reach
api.
Secure connection (port 443)
Reason Claude gave
To send approved expenses to the finance system as bills, so nobody has to type them in again.
The app's code mentions this service in src/xero.js.
If you approve
- Expense tracker can send data to api.payments-example.com and receive data from it. Approve only if you trust this service with what the app holds.
- It applies to this app only. Your other apps stay as they are.
- You can turn it off at any time from the app's page.
Sign-off
Asked by
Claude6 Nov 202614:01 UTC
Held by
Haechy, until you decide
Your decision
Approve or deny below
If you deny it, the app carries on without this service. Claude is told, so it can try another way or ask again with more detail.
Questions worth asking before you say yes
- Is the host the service you meant? A name that is one letter off, or a different ending, is not the same service.
- Does the reason match what you asked Claude to build? If you asked for a report and the reason talks about uploading files somewhere, ask Claude why.
- Is a wildcard needed? An exact host lets the app reach one place. A
*.domainentry opens every name under it. - Does the code really mention it? The page lists the files. No file at all, for a host the app doesn't obviously need, is a reason to ask.
- Would you be comfortable with the app's data going there? Once a host is approved, the app can send it anything the app holds. Haechy can't judge whether a service deserves it.
Approving does not make a service safe. It only means a person decided the app may talk to it.
Four requests, four answers
A payments service. Claude asks for the provider's own API host, exact, with the reason "to create invoices when an order is marked paid". That is what the app is for, the host is specific, so approving is reasonable. Keep the payment keys in app settings, out of the code.
A message to your chat tool. The host is the chat tool's incoming-message address, and the reason says "to post a summary every time a new request arrives". Fine, if that is the channel you meant. Remember that anything in the message is now in that tool.
A public data feed. An exchange-rate or weather API that needs no key. Low risk, but check that it is one host and not a wildcard.
A host you don't recognize. The reason says "to check for updates" and the host is a long random-looking name, or a lookalike of a service you use. Deny it, and ask Claude what the code is trying to reach and why. Denying costs nothing: Claude can ask again with a better explanation.
After you decide
Expense tracker wants to connect to api.
Your app, on Haechy
Expense tracker
expenses-
Outside service it would reach
api.
Secure connection (port 443)
Sign-off
Asked by
Claude6 Nov 202614:01 UTC
Held by
Haechy, until you decide
Your decision
Approved by you
An approved host is sent to the region's gateway shortly afterwards, and the app can reach it from then on. A denied host stays blocked. Approvals belong to one app, so another app that needs the same host has to ask separately.
To take access away, ask Claude to remove it (the remove_outbound_access tool) or open the app's page in the console. Removal takes effect at once, and Claude is always allowed to do it. An approval link works once. An old link says "This approval link is no longer valid." and points you to the app's page, where you can review every request.
Who can approve: the workspace owner and admins, signed in to the console. Admins are set when someone is invited to the workspace; see sharing and sign-in.
What Haechy refuses to open
Some requests can't be approved by anyone: raw IP addresses, names that only work inside a network (localhost, .local, .internal and similar), more than one wildcard, and haechy.app itself. The gateway also refuses private and loopback addresses and cloud-metadata addresses, whatever a name points to. Email server ports (25, 465, 587 and 2525) can never be approved. App email goes through Haechy's own email service instead (how apps send email).
What does the app see when a request is blocked?
If the app calls a host that hasn't been approved, the request is refused and the attempt is logged. A plain HTTP caller sees status 403 and the message "Blocked by Haechy: <host> is not an approved connection for this app. Ask Claude to request access." Node's built-in fetch shows blocked HTTPS calls less clearly, usually as "Request was cancelled". Ask Claude to look: list_outbound_access shows the hosts that were blocked in the last 14 days, with a count, so Claude can ask for the right one.