Skip to content
ReleasesGitHub

Manage MCP user sessions

Each Identity Provider’s Sessions tab lists the MCP user sessions of the people who signed in through it. Revoke a session to cut off the access that one sign-in through an MCP Client: An application (such as Claude Desktop, Claude Code, or Gemini CLI) that connects to MCP servers to access tools and resources on behalf of users.Learn more granted, or revoke every session for a user or an MCP client at once. For what a session is and what revoking one does, see MCP user sessions.

Prerequisites

Section titled “Prerequisites”
  • A role with Read Only or Read/Write permission on Identity Providers to view sessions, and Read/Write to revoke them. See Roles overview.
  • An Identity Provider that users sign in through to reach the MCP Identity Gateway: A component that brokers MCP traffic between MCP clients and target MCP servers, validating authorization and presenting Aembit-managed credentials on each request.Learn more.
  • A Client-to-Gateway Access Policy: Access Policies define, enforce, and audit access between Client and Server Workloads by cryptographically verifying workload identity and contextual factors rather than relying on static secrets.Learn more whose Credential Provider: Credential Providers obtain the specific access credentials—such as API keys, OAuth tokens, or temporary cloud credentials—that Client Workloads need to authenticate to Server Workloads.Learn more is an OIDC ID Token Credential Provider with Enable Refresh Token Support turned on. Other Credential Providers don’t create sessions.

View sessions

Section titled “View sessions”

  1. Log in to your Aembit Tenant: Aembit Tenants serve as isolated, dedicated environments within Aembit that provide complete separation of administrative domains and security configurations.Learn more.

  2. Click Administration in the left sidebar, then select Identity Providers.

  3. Click the Identity Provider that your users sign in through.

  4. Click the Sessions tab.

    The User Sessions table lists each session with these columns:

    ColumnWhat it shows
    User EmailThe user who signed in
    MCP ClientThe MCP client the user signed in through
    IssuanceWhen the user signed in
    ExpirationWhen the session’s refresh tokens stop working
    StatusActive, or Revoked for a session that you revoked or that expired
    ActionsThe Revoke session icon

  5. (Optional) To narrow the list, type part of an email address in Filter Users, select an MCP client from Filter MCP Client, or both.

The Sessions tab is available only after you save the Identity Provider. Revoked and expired sessions stay in the list for a time after they end.

Revoke a session

Section titled “Revoke a session”

  1. On the Sessions tab, find the session you want to revoke.

  2. In the Actions column, click the Revoke session icon.

  3. In the Revoke User Session dialog, click Revoke.

    Aembit Tenant UI shows “Session revoked successfully.”

The revoke takes effect within about a minute. The user can sign in again from the same MCP client, which creates a new session.

Revoke a user’s or an MCP client’s sessions

Section titled “Revoke a user’s or an MCP client’s sessions”

Revoke filtered revokes every active session that matches the current filters.

  1. On the Sessions tab, set the filters to the sessions you want to revoke:

    • To revoke a user’s sessions, type their email address in Filter Users.
    • To revoke an MCP client’s sessions, select it from Filter MCP Client.
    • To revoke one user’s sessions in one MCP client, set both.

  2. Check every page of the list, and make sure it shows only the sessions you want to revoke. Filter Users matches every email address that contains what you type, so bob@example.com also matches jimbob@example.com.

    If the list shows sessions you want to keep, revoke the others one at a time instead.

  3. Click Revoke filtered.

  4. In the confirmation dialog, click Revoke All when you filtered by user only, or Revoke Filtered when you selected an MCP client.

The Sessions tab has no action that revokes every session on an Identity Provider at once. To do that, use the POST /api/v1/sso-idps/{id}/user-sessions/revoke endpoint with revokeAll set to true. See the Aembit Cloud API.

Revoke sessions when deleting an Identity Provider

Section titled “Revoke sessions when deleting an Identity Provider”

When you delete an Identity Provider that still has active sessions, the delete dialog offers to revoke them first.

  1. On the Identity Provider’s Details tab, turn off the toggle to deactivate the Identity Provider. If a confirmation dialog appears, click Yes. You can delete only an inactive Identity Provider.

  2. Click the three-dot menu, then select Delete.

  3. In the dialog, keep Revoke all active user sessions before deleting checked, and click Revoke Sessions & Delete.

If you clear Revoke all active user sessions before deleting, the button changes to Delete. The sessions then keep working until they expire, and you can’t revoke them later, because their Identity Provider no longer exists. To cut off those users afterward, deactivate the Client-to-Gateway Access Policy that admits them, or its Credential Provider. Deactivating the Access Policy cuts off every user it admits. Deactivating the Credential Provider cuts off every Access Policy that uses it. Either way, access ends once the current access tokens expire and the next refresh fails.

Section titled “Related”