Resource consents

When an end user allows an API client to act on their behalf against a resource, such as an MCP server, Scalekit records that grant as a consent. Use scalekit.resources to read those consents and revoke them from your own admin screens instead of the Scalekit dashboard.

Each consent identifies the user by externalUserId—the identifier your application supplied when the consent was granted. The same audit and revoke actions are available in the dashboard under Managing MCP clients.

listUserConsents

classResourceClienthttps://github.com/scalekit-inc/scalekit-sdk-node/blob/main/src/resource.ts

#asynclistUserConsents

Lists the end-user consents granted against a resource, with pagination. Use this to audit who authorized a client, and to find the consentId you need before revoking.

Filter by user in one of two ways. Pass userIds to match external user IDs exactly and case-sensitively. Pass search for a case-insensitive substring match. When you give both, userIds wins and search is ignored.

paramresourceIdstring

The resource whose consents to list (format: res_...).

paramoptionsListUserConsentsOptions

Optional fields: search, pageSize (max 30), pageToken, userIds (max 25, takes precedence over search).

search, pageSize, pageToken, userIds

returnsListResourceUserConsentsResponse

Consents with id, externalUserId, clientId, clientName, scopes, and grantedAt, plus totalSize and the nextPageToken / prevPageToken cursors.

const res = await scalekit.resources.listUserConsents('res_abc123', {
  pageSize: 20,
  userIds: ['user_456'], // optional; takes precedence over search
});

console.log(res.totalSize, res.nextPageToken);
for (const consent of res.consents) {
  console.log(consent.id, consent.externalUserId, consent.clientId, consent.scopes);
}

revokeUserConsent

classResourceClienthttps://github.com/scalekit-inc/scalekit-sdk-node/blob/main/src/resource.ts

#asyncrevokeUserConsent

Revokes a single end-user consent held by an API client. The client is prompted for consent again on its next authorization attempt, and every active refresh token issued to that client for the same user is revoked.

Access tokens that Scalekit already issued stay valid until they expire. See How revocation affects active access tokens for ways to shorten that window.

paramclientIdstring

The API client that holds the consent (format: m2m_...), not the resource ID.

paramconsentIdstring

The consent to revoke (format: usrcnst_...), taken from listUserConsents.

returnsRevokeUserConsentResponse

Empty response on success. The call throws on failure.

await scalekit.resources.revokeUserConsent('m2m_abc123', 'usrcnst_xyz789');