Re-authenticate or edit an MCP session

Mints a fresh authentication flow against the same MCP client and identity as the existing row. Two branches based on row type:

• OAuth token (any non-orphaned row, typically needs_reauth — but active is also accepted) — opens a fresh upstream OAuth consent flow. Caller is expected to follow authorize_url to the provider; on callback the credential is replaced in place.
• Header credential (active or needs_update) — opens a fresh per-user-headers submission flow. Caller follows the same URL field to the Bifrost submission form; on submit the credential is replaced in place. kind: "headers" is set on the response.

Refused with 403 if the row is orphaned — a fresh credential wouldn’t help; the issue is the identity has lost access to the MCP, which the admin must fix.

POST /api/mcp/sessions/{id}/reauth

Error

A valid request URL is required to generate request examples

200

{
  "authorize_url": "<string>",
  "session_id": "<string>",
  "submit_url": "<string>"
}

Authorizations

Authorization · string · header · required

Management API authentication for /api/* endpoints. Use the Authorization header with Bearer <API key>. Virtual keys, dashboard/user/session tokens, and x-api-key headers are not supported on management APIs.

Path Parameters

id · string · required

Session row ID (OAuth token or header credential)

Response

200

application/json

Fresh flow opened

Response for POST /api/mcp/sessions/{id}/reauth. Returns the URL the caller must visit to complete the fresh authentication / resubmission.

authorize_url · string · required

Where the caller must go. For OAuth rows this is the upstream provider's authorize page (via a Bifrost intermediate). For header credential rows it's the Bifrost submission form for the new flow.

session_id · string · required

ID of the freshly-minted flow row

submit_url · string

Set only on header re-auth and identical to authorize_url. Kept for callers that want to be explicit about the underlying surface.

kind · enum<string>

Set only on header re-auth

Available options: oauth, headers