# Disconnect and revoke access

You can stop an assistant from making new requests to Stuff without deleting your files.

## Different disconnect controls

| Control | What it means |
| --- | --- |
| Turn Stuff off in one conversation | Stops that conversation from using the tool; the connection can still exist |
| Disconnect or remove Stuff in the assistant | Changes that assistant's connection; provider behavior varies |
| Disable or uninstall a coding-agent plugin | Removes its local tools and skills; does not by itself revoke its Stuff grant |
| Revoke in Stuff → Agents | Invalidates the selected Stuff connection so its future requests are denied |

For a complete disconnect, revoke in Stuff and remove the connection in the assistant. Other assistants use separate grants and remain connected unless you revoke those too.

For Claude Code, Codex and Cursor, inspect the plugin's connection separately from any direct MCP server or inherited web connector. Removing one configuration may leave another enabled. [Coding-agent guides](https://stuff.ac/file/97188272-dea9-4fd2-a368-8ba4212bb97c).

## Revoke in Stuff

1. Open **Agents** and find the correct entry under **Connected assistants & keys**.
2. Check its name, spaces, capabilities, and last use. A name is a label; inspect the actual scope too.
3. Choose **Revoke** on that entry.
4. Ask the assistant to make a **fresh tool request** for the test file. It should receive an authentication error. An answer recalled from chat history is not proof of continued access.

If you want different permissions later, create a new, appropriately scoped connection. Do not assume a revoked credential can be reused.

## A real before/after test

On **October 1, 2026**, we created a normal, separate Stuff demo account and a private **Project Lantern** space containing a fictional Markdown document. Its dedicated API connection could read and edit only that space. Organization and sharing were disabled.

We read the original document through the ordinary user API, revoked the key in the UI, and repeated the same request using the same key:

| Check | Result |
| --- | --- |
| Read before revocation | HTTP 200; returned the exact 296-byte synthetic document |
| Read after revocation | HTTP 401; `unauthorized`, “This connection is unavailable.” |
| Open the file as its owner afterward | Still available; revoking a connection did not delete the file |

![The demo connection is revoked and the access check reports unavailable](/api/v1/items/a15b70dd-a41a-4393-85a6-a09d1cbc99a8/content)

This proves revocation for the demonstrated API connection. It is not a claim that each assistant provider's disconnect button was exercised during this walkthrough. Existing provider connections were left intact.

## Three coding assistants: fresh requests after revocation

We also completed a real [Claude Code → Codex → Cursor handoff](https://stuff.ac/file/0eb413e9-22f2-4e84-b8ab-3743cfc851c8) on October 1, 2026, using separate OAuth grants for Project Lantern only. After creating and editing the same file through versions 1, 2 and 3, we revoked each grant in **Stuff → Agents** and requested the same file again in each client.

| Client | Fresh request after revocation |
| --- | --- |
| Claude Code, plugin MCP | Required reauthorization; no file content returned |
| Codex CLI, direct MCP | `Authentication required` |
| Cursor, local plugin MCP | `Unauthorized` |

![Cursor's fresh read is denied after its Stuff connection is revoked](/api/v1/items/5a7e9090-ecb1-49ce-99b5-e114280003ba/content)

We also revoked unused demo login attempts. The owner could still open the file at version 3 after a page reload. These results demonstrate revocation in Stuff, not every provider's own disconnect button. A client may describe the revoked credential as expired; the deliberate action here was revocation.

## What revocation cannot do

Revocation stops future authorization. It cannot recall content already downloaded, erase a provider's conversation history, or retract a response already authorized and in flight. Review the assistant provider's history, retention, and deletion controls separately. A public file also remains publicly readable until you change its sharing.

If a key might have leaked, revoke it first. Create a replacement with only the necessary scope, and update the client through its credential store. Do not send the old key in a support request.

[Privacy and assistant data](https://stuff.ac/file/182ad79e-64a6-4979-912a-542456e2b58b) · [All setup guides](https://stuff.ac/file/552c90a8-384e-4263-b71d-84c30beb2df1)