Reconnect, expire, revoke

Connections don’t last forever, and some shouldn’t last another minute. Here’s what ends one, what that looks like, and how to end one on purpose.

Before you start

You can revoke any connection or key you granted. Admins and the Owner can revoke anyone’s.
Everything here lives under Settings › Agents, in Access and the collapsed Revoked group below it.

Steps

Reconnect an expired connection

A browser-approved sign-in renews itself quietly: the client holds a one-hour pass and refreshes it, for up to 30 days between uses. Leave the client idle for 30 days, or let it lose its stored sign-in, and the row reads expired in the Revoked group, with “Sign in again from the client to reconnect.”

Run your client’s sign-in again: claude mcp login hydrant, codex mcp login hydrant, or Connect in Claude’s connector settings.
Approve the workspace in the browser. This creates a fresh connection row.
Ask the agent to read something, then check the new row says verified.

The old expired row stays in the Revoked group for the record. Hydrant revokes expired connections itself, every night and whenever someone adds a connection or key; once it has, the row has no Revoke button and holds no slot.

A connection marked via auth.md works differently. The agent renews it itself for 30 days from when it picked up your approval, however often it’s used, then it expires. To reconnect, ask the agent to register again and approve the new code. Let an agent register itself has the details.

Revoke a connection

Find its row under Access and press Revoke. Expired rows have no Revoke button; Hydrant already ended them.
Read the confirmation: the client loses access to this workspace immediately, its recorded work and history stay intact, and reconnecting needs a fresh approval.
Press Revoke. Or Keep connection if you were only looking.

Revoke a key

Find the key under Access.
Press Revoke on the key, then Revoke key. Keep key backs out.

What ends access without you pressing anything

The granting person leaves or is removed. Every key and connection they granted in that workspace stops immediately and permanently. Rejoining doesn’t revive them.
They’re demoted. Nothing is revoked, but the agent’s authority drops with theirs on its next request.
The account is suspended or deleted, or the workspace is deleted. Same result: the next request is refused.
It can’t sign in again. A connection whose sign-in ran out, or one approved more than a day ago that never finished signing in, is revoked by Hydrant. It reads expired in the Revoked group and gives its slot back.
A refresh token gets reused after its 30-second grace. Hydrant treats that as theft and revokes every sign-in that client holds for you, including its connections to your other workspaces. Sign in again from the client.

What you should see

“Connection revoked.” or “Key revoked.” The row moves to the Revoked group, kept for the record so the history still makes sense. The agent’s very next request fails with 401 and “Agent credential is unavailable.” A revoked entry gives its slot back to the plan limit.

Its past work keeps its byline, including any named agent it was shown as.

If it goes sideways

You revoked the wrong one. There’s no undo, and that’s the point. Approve again from the client; it takes a minute.
The client keeps saying it’s connected. It’s reading its own configuration. Trust the Access list.
“Free allows 2 agent connections per workspace, keys and OAuth combined, and every slot is taken.” Or the same with Solo Pro and 20. Expired connections give their slots back on their own; keys and connections you don’t use count until someone revokes them. Revoke what you don’t use, or move the Owner’s account up: Solo Pro allows 20, and Team stops counting. See Plans and billing.
“Revocation could not be confirmed.” The network ate the answer. Refresh the list before trying again; it may already be done.
A key leaked. Revoke it first, then create a new one. In that order. See Agent keys.