Managing connections

Every assistant you connect acts as you and can reach your own scorecards and submissions — nothing else, and nobody else’s. This page is about seeing what is connected and ending it when you want to.

Seeing what is connected

Connected apps in your admin lists every application currently connected to your account: what it is, what it is allowed to do, and when it connected.

Disconnecting

Press Disconnect on the row. Access ends immediately, and reconnecting means going through the approval screen again.

Removing the connector in the app is not enough

Removing a connector inside Claude, Cursor or any other client deletes that client’s copy of the token. It does not tell DimensionKit anything, so the token keeps working until it expires — up to an hour, and renewable for thirty days by a refresh token the client still holds.

If a laptop or phone is lost, disconnect it here. That is the only thing that ends access straight away.

Disconnecting never touches your scorecards or the submissions people have already made.

How long a connection lasts

Two clocks run behind the scenes:

	Lasts	What it is
Access token	1 hour	Sent with every request the assistant makes
Refresh token	30 days	Used quietly to get a new access token

Each refresh issues a new refresh token, so the thirty days restarts every time. In practice:

• An assistant you keep using stays connected indefinitely — you are not asked to approve it again
• One you stop using lapses after thirty days and has to be reconnected

Short access tokens mean a leaked one is useless within the hour. The long, rolling refresh token means nobody is nagged to re-approve a connector they use every week.

Changing what an assistant can do

Scopes are fixed for the life of a connection. To narrow or widen what an assistant may do, disconnect it and connect it again, approving the scopes you want on the way through. See Connecting a client.

For client authors

DimensionKit implements RFC 7009 token revocation at /oauth/revoke, advertised as revocation_endpoint in the authorization server metadata.

Call it when someone disconnects your integration, so the token dies with the connection instead of outliving it:

POST /oauth/revoke
Content-Type: application/x-www-form-urlencoded

token=<access or refresh token>&token_type_hint=access_token&client_id=<your client id>

• Revoking either token revokes both halves of the grant
• token_type_hint is optional, and a wrong one still works
• An unknown or already-revoked token returns 200, same as a real one
• A client may only revoke tokens it was issued