Renew and reconnect credentials

For: cluster and tenant administrators.

Understand token renewal and reconnect without interrupting a working connection.

Tokens that renew themselves

A connection whose provider answers its sign-in with a refresh token, such as a vendor's remote MCP server on your own OAuth app, keeps working without anyone signing in again: the edge renews its token before it expires, and when the provider rotates the refresh token, the new one replaces the old.

connection show says so (Refresh: the edge renews the token before it expires (<when>)), and so does the connection's page. However many calls come at once and however many edges you run, a refresh token is spent once.

The refresh token is sealed like the other secrets a connection saves, read only by the edge's refresh and sent only to the token endpoint it came from: never to a node, a tool, a log or a job.

Your app may be a public client, with PKCE and no client secret (GitLab's non-confidential applications, for example): nothing secret of yours is stored then but the tokens. A confidential client's secret goes only to the provider's token endpoint; on a host of your own (below), only to the host you pasted it for.

Reconnecting

When the provider refuses to renew the token (the refresh token was revoked, it expired, or someone signed the app out), the connection needs reconnecting. Its tools' calls get no token, and the agent reads that an admin connects it again; connection show and the Connections tab say why and since when, the audit trail has connection.reconnect, and the tenant's admins get an email once (rules can add the connection.reconnect notification). Connect it again as the first time:

oz0 connection show tracker
oz0 connection start tracker --open

A provider that could not answer for now (an outage) is not a refusal: calls keep the token in force while it lasts, and the edge tries again.