Reconnect, expire, revoke

Connections don’t last forever, and sometimes they shouldn’t last another minute. Here’s what ends one, what that looks like, and how to end one on purpose.

Before you start

• You can revoke any connection or key you granted. Admins and the Owner can revoke anyone’s.
• Everything here lives under Settings › Agents.

Steps

Reconnect an expired connection

A browser-approved sign-in renews itself quietly: a one-hour pass, refreshed by the client for up to 30 days. If the client isn’t used for 30 days, or loses its stored sign-in, the row under Connections reads expired with “Sign in again from the client to reconnect.”

1. Run your client’s sign-in again: claude mcp login hydrant, codex mcp login hydrant, or Connect in Claude’s connector settings.
2. Approve the workspace in the browser.
3. Ask the agent to read something, then check the row says verified.

Revoke a connection

1. Find the row under Connections and press Revoke.
2. Read the confirmation. It says the client loses access to this workspace immediately, its recorded work and history stay intact, and reconnecting needs a fresh approval.
3. Press Revoke. Or Keep connection if you were only looking.

Revoke a key

1. Open Agent keys › Manage agent keys.
2. Press Revoke on the key, then Revoke key.

What you should see

“Connection revoked.” or “Key revoked.” The row stays in the list, marked revoked, so the history still makes sense. The agent’s very next request fails with 401 and “Agent credential is unavailable.” A revoked entry gives its slot back to the plan limit.

What ends access without you pressing anything

• The granting person leaves or is removed. Every key and connection they granted in that workspace stops immediately and permanently. Rejoining doesn’t revive them.
• They’re demoted. Nothing is revoked, but the agent’s authority drops with theirs on its next request.
• The account is suspended or deleted, or the workspace is deleted. Same result: the next request is refused.
• A refresh token gets reused after its 30-second grace. Hydrant treats that as theft and revokes the whole sign-in. Sign in again from the client.

If it goes sideways

• You revoked the wrong one. There’s no undo, and that’s the point. Approve again from the client; it takes a minute.
• The client keeps saying it’s connected. It’s reading its own configuration. Trust the Connections list.
• “Free allows 2 agent connections per workspace, keys and OAuth combined, and every slot is taken.” Or the same with Solo Pro and 20. Expired and unavailable entries still count until someone revokes them. Revoke what you don’t use; Solo Pro on the Owner’s account allows 20.
• A key leaked. Revoke it first, then create a new one. In that order. See Agent keys.