Rotate, pause or disconnect an integration

Use this page when a connection stops working, such as when an OAuth grant is revoked or an API key leaks or expires. Use it too when you want a workflow to stop using a connection. How integrations work explains connections and how steps choose one.

Each task below is shown in the Anythink dashboard, with the CLI and with an AI assistant. Integration commands run through the MCP server in local stdio mode only. The hosted MCP server doesn't run them. See Connect Claude to your backend with MCP.

Task	Connection ID	Stored credentials	Workflows
Rotate an API key	New	Replaced	System and Current User steps use the new connection. Specific Connection (by ID) steps need the new ID.
Reconnect an OAuth connection	New	Replaced	As above
Pause a connection	Same	Kept	System and Current User steps stop using it. Resume it and they carry on.
Disconnect	Gone	Deleted	Steps fail unless another connection matches. See what happens to workflows.

Most commands take a connection ID. Run anythink integrations connections list to find it. In a narrow terminal the table wraps long IDs over several lines, so widen the window before you copy one. The dashboard doesn't show IDs.

Rotate an API key

Claude, OpenAI and Grok connect with an API key. There's no in-place key update. You disconnect the old connection and connect again with the new key, which creates a connection with a new ID. Anythink stores the new key encrypted and never shows it again.

In the Anythink dashboard

Go to Settings › Integrations, open the Integrations tab and select Disconnect on the provider's card.
Select Configure & Connect, paste the new key and select Save.
The card shows Connected.

With the CLI

bash

anythink integrations connections list --provider openai
anythink integrations disconnect <connection-id> --yes
anythink integrations connect openai --name "OpenAI"

connect prompts for the new key without echoing it, then prints the new connection's ID. Leave out --yes to see the connection's provider, name and scope and confirm first.

With an AI assistant (MCP)

Note: Rotate API keys in your own terminal. Through an assistant, the new key would be passed in the command and end up in your conversation.

An assistant can still tidy up around it. Connect the new key yourself with anythink integrations connect openai, then ask:

text

Using the anythink CLI, list my openai connections and disconnect the old one, <connection-id>.

The assistant calls the cli tool with integrations connections list --provider openai, then integrations disconnect <connection-id> --yes.

Once the new connection works, revoke the old key in the provider's own console. Disconnecting doesn't revoke it there.

Reconnect an OAuth connection

Reconnect when the provider revoked access, the token can no longer be refreshed, or the account that approved the app has changed. Your project's OAuth client ID and secret stay as they are. Only the connection changes.

In the Anythink dashboard

Go to Settings › Integrations and open the Integrations tab.
On the provider's card, select Reconnect.
Approve access again when the provider asks.

Reconnect deletes the current connection before the new authorisation starts. If you cancel at the provider, select Connect to finish.

With the CLI

bash

anythink integrations connections list --provider slack
anythink integrations disconnect <connection-id> --yes
anythink integrations oauth connect slack --name "Team workspace"

oauth connect opens your browser at the provider, waits up to five minutes for you to approve the app, then prints the new connection's ID. Add the CLI's callback URL, http://localhost:8745/callback, to the OAuth app's redirect URLs if you haven't already.

With an AI assistant (MCP)

text

Using the anythink CLI, disconnect Slack connection <connection-id> and connect Slack again.

The assistant calls the cli tool with integrations disconnect <connection-id> --yes, then integrations oauth connect slack, which opens your browser on your machine for you to approve the app.

Rotate an OAuth client secret

If you rotate the client secret in the provider's console, save the new one in your project. Existing connections keep working. Anythink uses the new secret the next time it refreshes a token or makes a connection.

CLI: anythink integrations oauth configure slack --client-id <CLIENT_ID> --client-secret <NEW_SECRET>. Leave out --client-secret to be prompted for it without echo. An assistant shouldn't run this, so the secret stays out of your conversation.
Dashboard: on the provider's card, select Edit OAuth, enter the new Client Secret and select Save. The Anythink dashboard then sends you to the provider's consent screen. Approving adds a second connection, so either close the screen or disconnect the old connection afterwards.

Pause a connection

Disable a connection to stop workflows using it without deleting its stored credentials. Enable it again when you're ready. The connection keeps its ID.

In the Anythink dashboard

The dashboard has no pause control. Use the CLI or an assistant. While a connection is paused, its card on Settings › Integrations shows as not connected. Don't select Configure & Connect or Connect there unless you want a second connection. Resume the paused one instead.

With the CLI

bash

anythink integrations disable <connection-id>
anythink integrations enable <connection-id>

With an AI assistant (MCP)

text

Using the anythink CLI, disable integration connection <connection-id>. Later, enable it again.

The assistant calls the cli tool with integrations disable <connection-id>, then integrations enable <connection-id>.

While a connection is paused, a step set to System (shared connection) or Current User (first connection) can't use it. It fails with "No credentials found for ", unless another enabled connection for the provider matches.

Disconnect for good

Disconnecting deletes the connection and the credentials Anythink holds for it.

In the Anythink dashboard

On the provider's card in Settings › Integrations, select Disconnect. The card returns to Configure & Connect, or Connect if the OAuth client is still saved.

With the CLI

bash

anythink integrations disconnect <connection-id>

The CLI shows the connection's provider, name and scope and asks you to confirm. Add --yes to skip the prompt, which scripts and assistants need.

With an AI assistant (MCP)

text

Using the anythink CLI, disconnect integration connection <connection-id>.

The assistant calls the cli tool with integrations disconnect <connection-id> --yes.

Disconnecting doesn't revoke the grant at the provider. Remove the app in the provider's settings too, for example your Google Account's third-party access page or your Slack workspace's app management.

What happens to workflows that use it

A workflow keeps running. Only its Integration step is affected, and records, triggers and other steps carry on as normal. Anythink looks up the connection each time a step runs, so there's nothing to redeploy.

Step's Credential Source	After you disconnect	After you rotate or reconnect
System (shared connection)	Fails with "No credentials found for ", unless another enabled project connection matches	Uses the new connection, with no change to the step
Current User (first connection)	Fails the same way, unless the triggering user has another enabled connection or a project connection matches	Uses the new connection, with no change to the step
Specific Connection (by ID)	The ID no longer exists, so the step falls back to Current User (first connection)	Needs the new ID

A failed step can hand over to another step. Link its failure handle, for example to a step that posts a warning. See Step types.

To point a Specific Connection (by ID) step at a new connection:

In the Anythink dashboard

Open the workflow, select the step, enter the new ID in Connection ID and save the step and the workflow.

With the CLI

bash

anythink workflows step-get <workflow-id> <step-id>
anythink workflows step-update <workflow-id> <step-id> --params '{"provider":"slack","operation":"send-message","credential_source":"connection","connection_id":"<new-connection-id>","inputs":{"channel":"#orders","text":"New order"}}'

Send the step's whole parameters object, as step-get shows it, with the new connection_id. If you store connection IDs on records and pass them in with a template, update those records too.

With an AI assistant (MCP)

text

Using the anythink CLI, show the parameters of step <step-id> in workflow <workflow-id>, then change its connection_id to <new-connection-id>.

The assistant calls the cli tool with workflows step-get, then workflows step-update with the full parameters.

Verify

Run anythink integrations connections list. A disconnected connection is gone. A paused one shows no in the Enabled column.
Trigger a workflow that uses the provider, then open View Job History in the dashboard or run anythink workflows jobs <workflow-id>. The step either fails with "No credentials found for ", or runs against the connection you expect.

Next steps

How integrations workIntegrations let workflows call Slack, Google Calendar, GitHub, LinkedIn, X and AI providers, using OAuth or API-key connections Anythink stores encrypted.

Let each user connect their own accountGive each user their own integration connection, such as their Google Calendar or an API key, so a workflow acts as the user who triggered it.

Post to Slack when a record is createdConnect Slack to your project, then build a workflow that posts to a channel whenever a record is created. Every step in the dashboard, CLI or an AI assistant.

Integration providers and operationsEvery integration provider and operation, with auth type, parameters and outputs, for Slack, Google Calendar, Google Analytics, Search Console, GitHub, LinkedIn, X, Claude, OpenAI and Grok.