---
title: "Revoke an MCP session"
method: DELETE
path: "/api/mcp/sessions/{id}"
tags: ["MCP"]
---

# Revoke an MCP session

`DELETE /api/mcp/sessions/{id}`

Revokes a session by primary key. Accepts these row kinds:
- OAuth token rows → hard-deletes the token plus any pending OAuth flow
  for the same binding (so an in-flight callback can't undo the revoke)
- Header credential rows → hard-deletes the credential plus any pending
  header submission flow for the same binding
- Pending per-user-headers flow rows → hard-deletes just the flow

Note: pending per-user OAuth flow rows are **not** revocable by this
endpoint — they expire naturally or are cleared when the bound token
row is revoked. To cancel a pending OAuth flow, revoke its parent token
(if one exists) or wait for expiry.

Bifrost does **not** call the upstream provider's revoke endpoint —
revocation is local. Per-user-headers credentials never call upstream.

## Path parameters

- `id` string, required

## Response `204`

Revoked

## Other responses

- `401` — Unauthorized — missing or invalid credentials
- `404` — Resource not found
- `500` — Internal server error

---

[API](https://skmtc.net/getbifrost/apis/bifrost-api.md) · [All operations](https://skmtc.net/getbifrost/apis/bifrost-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getbifrost/bifrost-api/versions/f8cab88f64ea/schema)