Revoke an agent's access

You can revoke an agent’s access at any time. It takes effect immediately: it can no longer read or do anything in your mailboxes.

Disconnect an agent

1. Open Settings → AI agents.
2. Under Connected agents, find the agent: “Claude”, “Claude Code”, “Heron CLI — machine name”… Each one shows when it was last used.
3. Click Disconnect and confirm.

You can reconnect it later from Claude (or with heron login for the CLI).

Cut everything at once

• Disconnect all revokes access for every connected agent.
• Or turn off the AI agent access switch: no agent can access anything anymore, but the connections stay listed. Turn it back on to restore access at the levels you chose.
• To remove access to a single mailbox, set it to No access.

From the agent itself

• CLI: heron logout revokes the CLI’s access and deletes its tokens.
• Claude: removing the connector in Claude doesn’t necessarily remove the authorization on Heron’s side; disconnect the agent in Heron too, to be sure.

Good to know

• An agent’s access tokens last 1 hour and are renewed automatically. The refresh token is valid for 60 days and extended each time it’s used: an agent unused for 60 days has to reconnect.
• Heron only keeps a fingerprint of these tokens, never the tokens themselves.
• Deleting your Heron account also disconnects all your agents.