Problem
Users can authorize MCP clients against the built-in OAuth server, but the dashboard gives them no way to see which clients hold a grant or to cut one off. The revocation endpoint already exists (app/api/oauth/revoke/route.ts, with the token store in lib/oauth/store.ts) — only the UI is missing, so revoking today means a manual call.
Proposed Solution
A Connected apps tab in workspace settings, alongside API keys:
- List authorized OAuth clients: client name, scopes, when authorized, last used
- Revoke per client, invalidating its access and refresh tokens
- Ideally a workspace-admin view of grants across members, not just your own
Additional Context
Settings tabs live in app/(dashboard)/[workspace]/settings/tabs/; api-keys-tab.tsx is the closest existing pattern.
Affected Package
Dashboard
Problem
Users can authorize MCP clients against the built-in OAuth server, but the dashboard gives them no way to see which clients hold a grant or to cut one off. The revocation endpoint already exists (
app/api/oauth/revoke/route.ts, with the token store inlib/oauth/store.ts) — only the UI is missing, so revoking today means a manual call.Proposed Solution
A Connected apps tab in workspace settings, alongside API keys:
Additional Context
Settings tabs live in
app/(dashboard)/[workspace]/settings/tabs/;api-keys-tab.tsxis the closest existing pattern.Affected Package
Dashboard