Description
When a third party MCP agent (Claude, ChatGPT) goes through the OAuth flow, the consent screen lets you pick access level and teams, but there's no way to set an expiry date on the access you're granting.
Right now the backend hard-codes the token lifetimes (30 min access token, 30 day refresh token), and the refresh window slides on every use, so in practice the grant lives forever as long as the agent keeps refreshing. The user has no say in it and no visibility of it.
What we'd want
- An expiry field on the consent screen (
frontend/src/pages/account/AccessRequestMCP.vue), similar to what the Personal Access Token dialog already does with its "Add Expiry Date" checkbox and date picker.
- The chosen date needs to flow through the consent endpoint and into
createMCPOAuthToken, and refreshing shouldn't be able to extend the grant past that date.
Might be worth deciding whether expiry should be optional (like PATs) or required.
Description
When a third party MCP agent (Claude, ChatGPT) goes through the OAuth flow, the consent screen lets you pick access level and teams, but there's no way to set an expiry date on the access you're granting.
Right now the backend hard-codes the token lifetimes (30 min access token, 30 day refresh token), and the refresh window slides on every use, so in practice the grant lives forever as long as the agent keeps refreshing. The user has no say in it and no visibility of it.
What we'd want
frontend/src/pages/account/AccessRequestMCP.vue), similar to what the Personal Access Token dialog already does with its "Add Expiry Date" checkbox and date picker.createMCPOAuthToken, and refreshing shouldn't be able to extend the grant past that date.Might be worth deciding whether expiry should be optional (like PATs) or required.