An apparatus for selectively granting permissions to group-based communication objects in a group-based communication system comprising a group-based communication server, a group-based communication repository, and a plurality of group-based communication channels, the apparatus comprising at least one processor and at least one memory including a computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to: generate an app user account comprising an app user account identifier and a third party application identifier, wherein the app user account is associated with a group identifier, the third party application identifier being associated with a third party application hosted by a third party application provider; generate, based on the group identifier, a candidate group-based communication object set comprising a plurality of group-based communication objects, the plurality of group-based communication objects comprising at least a first group-based communication channel from the plurality of group-based communication channels and a plurality of objects for the at least first group-based communication channel; generate a permissions interface configured to enable a user to authorize permissions for the third party application associated with the group identifier; generate a permissions table associated with the app user account, the permissions table comprising the third party application identifier and the group identifier; generate an app token comprising the third party application identifier and the group identifier; and transmit the app token to the third party application provider; wherein the app token comprises permissions, that provide, to the third party application, access to the at least first group-based communication channel and the plurality of objects for the at least first group-based communication channel; wherein the at least first group-based communication channel provides a virtual communication feed to display messaging communications posted by channel members, the third party application accessing the at least first group-based communication channel with the app user account based on the app token. generate an app user account comprising an app user account identifier and a third party application identifier, wherein the app user account is associated with a group identifier, the third party application identifier being associated with a third party application hosted by a third party application provider; generate, based on the group identifier, a candidate group-based communication object set comprising a plurality of group-based communication objects, the plurality of group-based communication objects comprising at least a first group-based communication channel from the plurality of group-based communication channels and a plurality of objects for the at least first group-based communication channel; generate a permissions interface configured to enable a user to authorize permissions for the third party application associated with the group identifier; generate a permissions table associated with the app user account, the permissions table comprising the third party application identifier and the group identifier; generate an app token comprising the third party application identifier and the group identifier; and transmit the app token to the third party application provider; wherein the app token comprises permissions, that provide, to the third party application, access to the at least first group-based communication channel and the plurality of objects for the at least first group-based communication channel; <EOS>