My bank, Capital One 360, has something like this. You can give a read-only access token to an external service and change/disable it at will.