Revoking Access

How to take access away — from an AI assistant, an API key, or a stolen session — and know it actually went away.

Why this page exists

Giving something access to your Enori account is a two-click affair. Taking it away is the part people get wrong, usually in the same way, and usually without finding out until it matters.

Everything on this page happens in Settings → API Keys, in the dashboard. Access can be granted to two kinds of thing, and they revoke differently:

The thing most people get wrong

Removing the connector inside Claude or Cursor does not revoke anything on Enori's side.

When you authorise an AI client, it stores a credential for your Enori account. Deleting the connector in that client's settings deletes the client's copy of the address — it does not tell Enori to forget the credential. The authorisation stays live on your account until you end it here.

That matters most in exactly the situation where you thought you were safe: a laptop you no longer have, a tool you stopped trusting, a contractor's machine. If the only thing you did was remove the connector on that machine, the access is still valid.

To actually end it: Settings → API Keys → Connected AI Clients → Disconnect.

Disconnecting an AI client

The Connected AI Clients section lists every AI tool currently authorised on your account.

Each row shows:

• Connected — the date you first authorised it.
• The scope it was granted, as a badge.
• Last used — the most recent time it refreshed its access.
• Expires — the date the authorisation lapses by itself if you never touch it.

If nothing is connected, the section says so rather than disappearing. "No AI clients are connected" is the answer you came to the page for; a section that vanished when the answer was good would be indistinguishable from one that failed to load.

To disconnect: click Disconnect on the row, then Confirm. It takes effect immediately — the client is signed out and has to be re-authorised from scratch to come back.

Why the rows don't say "Claude" or "Cursor"

Because Enori cannot honestly tell you. AI clients register themselves and pick their own display name in the process, and nothing binds that name to the credential — a name shown here would be an unverified string presented as if it identified the software. The connection date, last-used date and scope are things we actually know, so those are what you get.

In practice you rarely need the name: if you have one AI tool connected, that row is it. If you have several and cannot tell them apart, disconnect them all and re-authorise the one you want — re-authorising takes a few seconds.

Rotating an API key

Rotating replaces a key's secret while leaving the old one working for a short while, so you can update your deployments without an outage.

Use it when a key has simply been around too long, when someone who had it has left, or any time you would like a fresh secret without a scramble.

1. Find the key in Settings → API Keys and click Rotate.
2. Click Confirm.
3. The new secret appears once, with a Copy button and the warning "Copy this key now. It will not be shown again." Copy it into your secrets manager before you close the dialog — Enori stores only a hashed copy and genuinely cannot show it to you again.
4. The dialog also tells you when the previous secret stops working. That is your deadline for updating everything still using the old one.

The old secret keeps working for 24 hours. Both keys are valid during that window, so callers you have not updated yet keep succeeding. When the window closes, the old secret stops — and nothing else will warn you, which is why the deadline is worth writing down.

Screenshot: the rotate confirmation and the new-secret dialog, with the "previous secret keeps working until…" line visible.

While the window is open, the old key stays in your list carrying an amber Stops working <date> badge. That badge is the only place the deadline lives after you close the dialog.

A rotated key uses one extra slot, briefly

During the overlap you have both keys, which is one more than usual. Your plan's limit is relaxed by exactly one to allow it, so a rotation never fails just because you were at your limit — the alternative would be refusing a security operation at the moment you most want it. Once the old key expires, you are back to your normal count.

If a rotation is refused because too many keys are live, revoke one you no longer need, or wait for an earlier rotation's overlap to run out.

What rotation does not change

• The key's name, scopes and ID stay as they were. Rotation replaces the secret, not the key's identity or permissions.
• An expiry the key already had is kept, not extended. A key you deliberately set to expire keeps expiring on schedule; a rotation is not a renewal.
• An already-expired key cannot be rotated. There is no live secret to overlap with, so Enori asks you to delete it and create a new one instead. Expired keys do not offer a Rotate button.

Revoking an API key outright

Revoke is the other option, and it is not a gentler one: it deletes the key immediately, with no overlap. Every caller still using it starts failing at once.

That is the right choice when a key has leaked. When a secret is in the wrong hands, a 24-hour grace period is 24 hours of continued access for whoever has it — so rotate for hygiene, revoke for incidents.

Knowing when a key is about to stop working

A key with an expiry set shows it in the list:

A key can reach the expired state two ways: you gave it a lifetime when you created it, or it is the old half of a rotation whose window has closed. Either way, an expired key authenticates nothing.

If a session is stolen

Enori's sign-in credentials refresh themselves as you use the product, and each refresh retires the previous one. If a retired credential is ever presented again — the signature of someone having copied your session and using it alongside you — Enori does not quietly serve both. It ends that entire sign-in chain: the copied credential and the original both stop working, so a stolen session turns into a forced re-login rather than quiet shared access.

Two things worth knowing about how that feels in practice:

• It ends the affected sign-in, not your whole account. Other sessions — another browser, your phone, a connected AI client — are separate chains and keep working. Signing out normally is also just a sign-out; it does not trip anything.
• An unexpected sign-out can be the system catching a copied session rather than a glitch. If you are signed out for a reason you cannot explain, sign back in, then check Connected AI Clients for anything you do not recognise and disconnect it.

You do not configure any of this and there is nothing to switch on.

For client developers: the revocation endpoint

If you are building an MCP client, you can hand back an authorisation without your user visiting the dashboard. Enori implements RFC 7009 token revocation:

POST https://mcp.enori.io/oauth/revoke
Content-Type: application/x-www-form-urlencoded

token=<the refresh token you hold>

It is advertised as revocation_endpoint in the server's discovery document, so a client that speaks RFC 7009 will find it without being told.

Two behaviours worth designing around:

• It revokes the whole authorisation, not just the token you name. A client part-way through a refresh may hold a successor this request never mentions; revoking only the named token would leave that one alive.
• It always answers 200 — including for a token that is unknown, expired, or already revoked. A status that varied with whether the token existed would let anyone test stolen tokens against it. The only error is forgetting the token parameter itself.

Calling this on sign-out or on connector removal is the well-behaved thing to do, and it is what makes "remove the connector" mean what users already assume it means.

FAQ

I removed the Enori connector from Claude. Am I done?

No. That removes Claude's copy of the credential; the authorisation is still live on your account. Disconnect it in Settings → API Keys → Connected AI Clients.

Can I manage keys or disconnect clients using an API key?

No. Both surfaces require you to be signed in to the dashboard. An API key cannot create, rotate, revoke, or list keys, and cannot disconnect AI clients — a leaked key therefore cannot be used to entrench itself or to lock you out of your own credentials.

I rotated a key and something broke immediately. Why?

Rotation does not break the old secret immediately — it stays valid for 24 hours. Something breaking at the moment of rotation is usually a caller that was already using a different key, or one that reads its key at startup and needs a restart to pick up a change you made elsewhere. Check which key the failing caller actually holds.

How long do I have after rotating?

24 hours from the moment you confirmed. The exact cut-off is in the dialog, and afterwards on the old key's amber badge in the list.

Can I make the overlap shorter than 24 hours?

Not from the dashboard — the button always uses the full window. If you need the old secret dead sooner, rotate and then Revoke the old key once your deployments are updated. That gives you the same result at a time you choose.

An AI client disappeared from the list on its own. What happened?

Authorisations lapse if they go unused — the Expires date on each row is when that happens. A client that has not connected since then is gone by itself and would have to be re-authorised anyway.

I disconnected a client but it is still working.

Give it a moment and refresh the page to confirm the row is gone. If a client genuinely still works after the row disappeared, it is using an API key rather than an OAuth authorisation — those are separate, and a key is revoked from the key list above, not from Connected AI Clients.

Troubleshooting

Related documentation

• Account & Settings — creating API keys, scopes, and your plan's key allowance
• MCP Server — connecting Claude, Cursor and other AI clients in the first place
• Teams — removing a person's access to shared monitors, which is a different thing from revoking a credential

Last updated: 2026-08-25. Feedback or corrections: support@enori.io