Manage application connections

The Application connections page in the Elastic Cloud Console gives organization administrators a single place to audit, revoke, and delete OAuth client connections that members of your organization have authorized across their Serverless projects.

To create an OAuth client or connect an MCP host such as Claude Desktop, refer to OAuth for MCP clients. This page covers organization-level management only.

Before you manage application connections:

• You have access to the Elastic Cloud Console for your organization. To open the page, go to Organization → Security settings → Application connections.
• Your role determines what you can view, revoke, and delete:
  • Organization owners see every application connection in the organization.
  • Other users see connections for the projects they administer, plus any connections they authorized themselves.

The Application connections page shows each OAuth client and its connections.

The page offers two views, toggled by the Group by client and List view buttons:

• Group by client: Lists each OAuth client with a count of its connections.
• List view: Shows all connections in a flat, sortable table.

In grouped view, expand a client to see its individual connections. Each connection row shows the following details:

To narrow the list, use the search box to filter by name, or use the Status filter.

If no project in your organization has any OAuth client connections yet, the page shows an empty state. Open a Serverless project to begin. Connections appear here once users start authorizing OAuth clients.

A connection has one of the following statuses:

• Active: The connection is authorized. The session may have expired if unused for 30 or more days.
• Expired: The connection's refresh window lapsed after 30 days of inactivity. The user must re-authorize to use it again.
• Revoked: The connection was revoked and can no longer be used.

Revoked connections remain visible for 90 days and revoked clients for 1 year. Expired connections remain visible until re-authorized or removed.

Select a client to open its details panel. The panel shows the connection details a user needs to configure an MCP host, for reference:

• Client ID: The unique identifier for the OAuth client.
• MCP server URL: The redirect URIs configured for this client. These are the callback URLs used during the OAuth authorization flow.
• If a client secret is configured, an indicator that a client secret is required for this client.

To create or edit a client, click Manage MCP client to open the project's MCP clients page in Kibana.

Revoking removes the selected connections only. The OAuth client stays registered and can accept new connections, and an application can be reconnected at any time.

To revoke a single connection, click Revoke in its row.

To revoke several connections at once:

1. Select the checkbox for each connection you want to revoke. In grouped view, use Select all connections for this client to select every connection under a client, or Clear selection to start over.
2. Click the bulk revoke button, which displays the number of selected connections, for example: Revoke 9 connections.
3. Review the connections in the confirmation dialog, then click Revoke.

You can revoke up to 100 connections at a time.

To revoke an entire OAuth client and all its connections, revoke it from the project's Agent Builder client management in Kibana. Refer to Revoke or delete an OAuth client or connection.

Deleting a revoked connection permanently removes it immediately instead of waiting for the 90-day retention period. This action can't be undone.

To delete a single revoked connection, click Delete in its row.

To delete several revoked connections at once:

1. Select the checkbox for each revoked connection you want to delete. In grouped view, use Select all connections for this client to select every revoked connection under a client, or Clear selection to start over.
2. Click the bulk delete button, which displays the number of selected connections, for example: Delete 9 connections.
3. Review the connections in the confirmation dialog, then click Delete permanently.

You can delete up to 100 connections at a time.

To restore access after revoking a client, create a new OAuth client and distribute the credentials to users.

• Create or edit an OAuth client in Elastic Agent Builder
• Connect an MCP host to Elastic Agent Builder
• Revoke or delete an OAuth client or connection
• OAuth for MCP clients