---
title: "Re-authenticate or edit an MCP session"
method: POST
path: "/api/mcp/sessions/{id}/reauth"
tags: ["MCP"]
---

# Re-authenticate or edit an MCP session

`POST /api/mcp/sessions/{id}/reauth`

Mints a fresh authentication flow against the same MCP client and identity
as the existing row. Two branches based on row type:

- **OAuth token** (any non-`orphaned` row, typically `needs_reauth` —
  but `active` is also accepted) — opens a fresh upstream OAuth consent
  flow. Caller is expected to follow `authorize_url` to the provider;
  on callback the credential is replaced in place.
- **Header credential** (`active` or `needs_update`) — opens a fresh
  per-user-headers submission flow. Caller follows the same URL field
  to the Bifrost submission form; on submit the credential is replaced
  in place. `kind: "headers"` is set on the response.

Refused with 403 if the row is `orphaned` — a fresh credential wouldn't
help; the issue is the identity has lost access to the MCP, which the
admin must fix.

## Path parameters

- `id` string, required

## Response `200`

Fresh flow opened

- MCPSessionReauthResponse — Response for POST /api/mcp/sessions/{id}/reauth. Returns the URL the caller must visit to complete the fresh authentication / resubmission.
  - `authorize_url` string, required — Where the caller must go. For OAuth rows this is the upstream provider's authorize page (via a Bifrost intermediate). For header credential rows it's the Bifrost submission form for the new flow.
  - `submit_url` string — Set only on header re-auth and identical to authorize_url. Kept for callers that want to be explicit about the underlying surface.
  - `session_id` string, required — ID of the freshly-minted flow row
  - `kind` 'oauth' | 'headers' — Set only on header re-auth

## Other responses

- `401` — Unauthorized — missing or invalid credentials
- `403` — Row is orphaned — re-auth would not restore access
- `404` — Resource not found
- `500` — Internal server error

---

[API](https://skmtc.net/getbifrost/apis/bifrost-api.md) · [All operations](https://skmtc.net/getbifrost/apis/bifrost-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/getbifrost/bifrost-api/versions/f8cab88f64ea/schema)