> ## Documentation Index
> Fetch the complete documentation index at: https://docs.uplink.build/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke access

> Cut off an AI client's access to your Uplink organization

Every AI client that signs in through the remote MCP server appears in Uplink Console under **Settings → Authorized apps**. From there an admin can end every session that client currently holds against the organization.

## Where to find it

1. Open [Uplink Console](https://console.uplink.build).
2. Go to **Settings** (organization settings, in the sidebar).
3. Scroll to the **Authorized apps** card.

Each row shows the app's name, its client identifier (a URL when the app registered via a [Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/) — Claude Code, Cursor, and similar hosts), the scopes it holds, when it was first and last authorized, and the number of live grants it currently has against your organization.

## Revoke a client

Click **Revoke** next to the app. Uplink confirms, then invalidates every refresh token that client holds against the organization. The next time the app tries to call an Uplink tool, it gets a 401 and — if the host supports it — walks its user through re-authorizing.

<Info>
  Revoke is admin-only. If your role is developer, the button is hidden; ask an org admin to revoke.
</Info>

<Warning>
  Revoke is per organization, not per user. If several members of the org signed in through the same client, revoking cuts off all of them.
</Warning>

## What revoke doesn't do

* **It doesn't uninstall the MCP.** The client stays configured in the user's AI host. Removing it there is separate.
* **It doesn't cancel in-flight tool calls.** Whatever the client is doing right now finishes on the current token; the next call after that fails.
* **It doesn't stop a client using its own `client_id` / `client_secret`.** Revoke covers apps a user authorized through the browser flow. A client authenticating with `client_credentials` has no user grant to revoke — delete the OAuth client from **Project settings → OAuth clients** instead.