Skip to main content

​
Token lifetimes

  • Access token — valid for 1 hour. Used as the Authorization: Bearer … header on every MCP request. Your client refreshes it automatically.
  • Refresh token — valid for 30 days from last use. Single-use. Each refresh issues a new pair and invalidates the previous one.

​
Revocation

Removing the Botdog connector from your AI client revokes its tokens when the client supports OAuth token revocation (POST https://api.botdog.co/oauth/revoke). You can also disconnect an app from Botdog under Settings → Integrations → AI apps. Members can disconnect their own connections; team owners and admins can disconnect anyone’s. The app loses access on its next request.

​
Refresh token replay detection

If a refresh token is presented twice (which only happens when it’s been copied to a second machine), we revoke every token for that app + team and force a full re-authorization. An MCP_OAUTH_REVOKED activity entry is recorded with reason refresh-replay.

​
Idle expiry

A connection unused for 14 consecutive days is auto-revoked. Reconnect to resume.

​
Audit log

Every tool call is logged with the tool name, the connecting app, the member, the IP address, duration, outcome, and a hash of the call inputs — never the raw inputs. Connections, disconnections and changes to the team’s read-only policy are logged too. Team owners and admins can review the whole team’s log under Settings → Integrations → AI apps; members see their own entries.

​
Data scope

A token is bound to one team and cannot read or write across team boundaries. Write tools also require you to hold a seat on that team; read tools don’t. A team owner or admin can also limit every connected app to read-only (see Scopes). Tokens for one resource (the MCP server) cannot be used against any other Botdog endpoint.