One device, one deliberate tap.
Pairing an app to a business account is the moment worth getting right. Here is exactly what happens, and what a connected device can and cannot do.
Three steps, and the third is yours
The unauthenticated app asks; the answer comes from a device that has already proved who it is.
Workspace shows a code
A QR on its own screen. Any phone camera reads it — there is no scanner to install and no camera permission to grant inside Quooro.
Your phone lands in your account
Already signed in, on a page that names the device asking and where it asked from — read from the request itself, never from the link.
You look, then you tap
Nothing is approved by opening the page. It says what access is being granted and waits for a deliberate tap.
Only ever approve a code you are looking at. The one real weakness of this kind of pairing is somebody showing you their code and asking you to scan it — which would connect their app to your business. No amount of cryptography helps, because you would be the one tapping Connect. The approval screen says this, in those words, every time.
Neither credential is kept
The code is short-lived because it is on a screen
Thirty seconds typed, two minutes scanned, one use. A credential anybody in the room can read has to expire while they are still reading it.
The connection is long-lived because it has to survive
It works until you disconnect it. There is no expiry to be caught out by and no refresh to go wrong — and revoking it stops the device the same second.
Both are stored only as a one-way hash
The readable version exists at the moment it is made and in the hands of whoever it was made for. A copy of the database links nobody to anything.
A connected device is not a key to Quooro
It has one address to call, and that address has no way to name an account — it resolves to the person who approved it and returns a fixed summary built for them. There is nothing in the request to tamper with, and no query it can pass through.
And it cannot widen its own access
The only thing a paired device may change about its own connection is to end it. Not what it can see, not the name it gave, not who it belongs to. Giving Workspace a new capability is a deliberate change on Quooro's side — slow on purpose.
More about Quooro Workspace
A connection is a thing you made on purpose, can see in a list, and can end in one button. That is the whole of the arrangement.