> ## Documentation Index
> Fetch the complete documentation index at: https://docs.concatflow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke, replace and rotate

> Cut an agent off, move it to a new machine, or change the database password.

## Revoke an agent

Open the dataset settings, find the agent and select **Revoke**, then **Revoke agent**.

Concatflow cuts its connection at once. The agent can never reconnect with those credentials, even after a restart. Nothing has to happen on your machine for this to work.

The container itself keeps running and logs connection errors:

```text theme={"system"}
ERROR nats.aio.client nats: encountered error
nats.errors.Error: nats: 'Authorization Violation'
```

Stop and remove it:

```bash theme={"system"}
docker rm -f cubit-agent
docker volume rm cubit-agent
```

> [!WARNING]
>
> If you revoke your only agent, the dataset stops answering until you install a new one with a new token.

## Replace a machine

1. Install a new agent on the new machine with a new token. See [Run two agents](https://docs.concatflow.com/private-databases/guides/high-availability.md).
2. Wait until it shows as **Online**.
3. Revoke the old agent, then remove its container and volume.

Doing it in this order keeps the dataset online the whole time.

## Change the database password

The password only lives in `DATABASE_URL`, on your machine. Concatflow is not involved.

1. Change the password in the database.
2. Recreate the container with the new `DATABASE_URL` and the **same** volume. Leave out `CUBIT_ENROLL_TOKEN`: the agent is already enrolled.

```bash theme={"system"}
docker rm -f cubit-agent
docker run -d --name cubit-agent --restart unless-stopped \
  --hostname db-agent-1 \
  -e DATABASE_URL="postgresql://concatflow_reader:<new-password>@<host>:5432/app" \
  -v cubit-agent:/data \
  ghcr.io/usecubit/source-client:0.1.0
```

## Cancel a token

A token you generated but never used stays valid for 7 days. To kill it sooner, select **Cancel the token** in the dashboard. Generating a new token also cancels the previous one.

## A token you did not use

If your agent fails with `token_used` and you never ran an agent with that token, someone else did. The dashboard shows the machine that used it. Revoke that agent, generate a new token and start your agent with it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.