What happens when you click Connect

You click Connect on the Connections page. About ten seconds later your lists start filling in. This post walks through everything that happens in between, so you know what you are agreeing to before you agree to it.

Step 1: we send you to your provider

Where the provider supports OAuth (Mailchimp, HubSpot, Klaviyo, Kit and others), the Connect button sends you to that provider's own login page. You never type your provider password into ListFunnel. We do not see it. Before the redirect we set a short-lived cookie holding a random code. When you come back, the code in the cookie must match the code the provider returns. That check stops anyone from tricking your browser into connecting someone else's account to your workspace.

A few providers need one fact from you before the redirect. Shopify needs your store handle. Marketing Cloud needs your subdomain. Zoho needs your region. For those you see a single text field first, then the same consent screen as everyone else.

Step 2: the consent screen

Your provider shows a screen that names ListFunnel and lists what we want. We ask for the least the job needs: read your lists and read the subscribers on them. For HubSpot that is two read scopes on contacts and lists. For Klaviyo it is lists:read and profiles:read. For Kit it is the one public scope Kit offers. Mailchimp has no scoped permissions, so its screen asks for account access, and we use it only to read audiences and members.

What we never ask for: permission to send email, permission to edit or delete subscribers, permission to change your account, or billing access. If a consent screen ever shows those, something is wrong. Close the tab and tell us.

Step 3: you click Allow

The provider sends your browser back to listfunnel.ai with a one-time code. Our server trades that code for an access token, over an encrypted connection, using a client secret that only our server holds. The token is what lets us read your subscribers. We encrypt it and store it against your workspace. The plain token never touches the database.

Right after the exchange we make one cheap call to prove the token works and to learn what later calls need: your Mailchimp data center, your AWeber account id, your Drip account id. If that call fails with a permission error we tell you the connection was rejected and store nothing.

Step 4: the sync starts on its own

The redirect back to the Connections page returns at once. In the background we queue a sync run for the new connection. There is no third button. You watch audiences appear, then subscriber counts climb, then a last-synced time land. A long list takes minutes. A short one takes seconds.

The whole path, from your click to the first subscriber landing, is usually under fifteen seconds. Most of that is your provider's login and consent pages. Our part is two server calls and a redirect.

Where there is no OAuth

Some providers offer no OAuth to outside apps. ActiveCampaign, SendGrid, Customer.io and about twenty others work with an API key instead. For those the Connect button opens a field for the key and a link straight to the page in your provider where the key is made, with one sentence saying what to copy. Paste, click Connect, and the same sync starts. The key is encrypted the same way the token would be. One click where the platform allows it, a pasted key where it does not.

If a token stops working

• Most providers expire tokens after an hour or a day. We refresh them before they expire, in the background, and write the new one back.
• If the provider refuses the refresh (you revoked us, or changed your password), the connection shows Reconnect. Click it and you repeat the consent screen. Your lists stay.
• Nothing about your lists or your resolved people depends on the token staying alive. The token only matters for the next sync.

Undoing it

Disconnect on the Connections page deletes the stored token or key. Your lists and the people already resolved stay in your workspace. They just stop refreshing. If you also revoke ListFunnel inside your provider's connected-apps page, the token is dead on both ends. Do both if you want to be sure.