# Reconnect, expire, revoke

How long an agent's sign-in lasts, how to reconnect it, and how to cut off a connection or key immediately.

Connections don't last forever, and sometimes they shouldn't last another minute. Here's what ends one, what that looks like, and how to end one on purpose.

## Before you start

- You can revoke any connection or key you granted. Admins and the Owner can revoke anyone's.
- Everything here lives under **Settings › Agents**.

## Steps

### Reconnect an expired connection

A browser-approved sign-in renews itself quietly: a one-hour pass, refreshed by the client for up to 30 days. If the client isn't used for 30 days, or loses its stored sign-in, the row under **Connections** reads **expired** with "Sign in again from the client to reconnect."

1. Run your client's sign-in again: `claude mcp login hydrant`, `codex mcp login hydrant`, or **Connect** in Claude's connector settings.
2. Approve the workspace in the browser.
3. Ask the agent to read something, then check the row says verified.

### Revoke a connection

1. Find the row under **Connections** and press **Revoke**.
2. Read the confirmation. It says the client loses access to this workspace immediately, its recorded work and history stay intact, and reconnecting needs a fresh approval.
3. Press **Revoke**. Or **Keep connection** if you were only looking.

### Revoke a key

1. Open **Agent keys › Manage agent keys**.
2. Press **Revoke** on the key, then **Revoke key**.

## What you should see

"Connection revoked." or "Key revoked." The row stays in the list, marked revoked, so the history still makes sense. The agent's very next request fails with `401` and "Agent credential is unavailable." A revoked entry gives its slot back to the plan limit.

## What ends access without you pressing anything

- **The granting person leaves or is removed.** Every key and connection they granted in that workspace stops immediately and permanently. Rejoining doesn't revive them.
- **They're demoted.** Nothing is revoked, but the agent's authority drops with theirs on its next request.
- **The account is suspended or deleted, or the workspace is deleted.** Same result: the next request is refused.
- **A refresh token gets reused after its 30-second grace.** Hydrant treats that as theft and revokes the whole sign-in. Sign in again from the client.

## If it goes sideways

- **You revoked the wrong one.** There's no undo, and that's the point. Approve again from the client; it takes a minute.
- **The client keeps saying it's connected.** It's reading its own configuration. Trust the Connections list.
- **"Free allows 2 agent connections per workspace, keys and OAuth combined, and every slot is taken."** Or the same with Solo Pro and 20. Expired and unavailable entries still count until someone revokes them. Revoke what you don't use; Solo Pro on the Owner's account allows 20.
- **A key leaked.** Revoke it first, then create a new one. In that order. See [Agent keys](/help/agents/agent-keys).

Contact: bots@hydrant.dev