Connected browsers

A connected browser is one Chrome profile holding a token for your account. Issue Mint lists them under Connected browsers, on the Extension page in the dashboard sidebar, which is the same page the pairing code comes from.

That token is what lets the Chrome extension put a page into an issue without you signing in again. It is narrower than your own login, on purpose.

What a connected browser can do

A connected browser can read your newsletters and their sections, list the issues you could still add to, create a draft issue, and add a link.

That is the whole list. The issues it can see are drafts and scheduled issues only, up to 20 per newsletter, newest number first, so a sent issue never appears as an option. Adding a link puts it in the issue you picked or parks it in your library if you picked that instead, and either way it arrives in the composer for you to edit before anybody reads it.

What it cannot do

A connected browser cannot send or schedule an issue, change any setting, read your subscriber list, see your analytics or touch billing.

An extension token carries one permission, and the server works out what that permission allows from the account the token belongs to rather than from anything the browser claims. So a newsletter id or an issue id sent by the extension proves nothing on its own: if it is not yours, the answer is that it does not exist. The endpoints, and the exact shape of each one, are written down in the extension API reference, and how Issue Mint holds credentials covers the rest of it.

What the list tells you

Each row shows the browser’s name and when it was last used, with Disconnect beside it. A browser that has paired but never saved anything reads “never” in that column.

The name is whatever the extension sent when it paired, which is its platform, and it falls back to “Chrome extension” if it sent nothing. Two rows can therefore look alike if you pair two profiles on the same machine, and the last used times are how you tell them apart. There is no row for your dashboard session: this list is the extension and nothing else.

Disconnecting, from either end

Both ends revoke the same token, so either one is enough on its own.

In the app, press Disconnect on the row. That browser stops working the next time it tries to save a link, and the popup shows its pairing screen again. In the extension, its options page has Disconnect this browser, which revokes the token on the server and clears it locally whatever the server answers, so a borrowed laptop is left with nothing on it either way.

Reconnecting always means a fresh code, because a revoked token cannot be reinstated. If a browser keeps dropping out rather than being disconnected once, the disconnection troubleshooting page is the one to read.

Pairing codes, and why there is only ever one

The pairing code is 8 characters long, lasts 10 minutes and works once. Generating a new one expires any earlier unused code, so the code on screen is always the only code that works.

Its alphabet leaves out the characters that get misread for one another, because this is read off one screen and typed into another. A code that is wrong, expired or already used gets the same answer, which is deliberate: telling somebody which of the three it was tells them more than they should know. Pairing is also rate limited per network address, at five attempts a minute and twenty an hour, and the extension’s own requests are limited to sixty a minute per account.

What is kept in the browser

The extension stores the token, the newsletter you used last and the category you used last, in Chrome’s own storage for that profile. Nothing else.

Disconnecting cannot reach into a browser and empty its storage, which is why revocation is the part that protects you rather than the clearing: a token copied off a disk stops working the moment its row is gone from Connected browsers.