A coding plugin can have a device credential listed separately from the AI app's MCP connection. You can remove that credential in Settings → Connections, under Plugin tokens.
Find the client name and check its last-used information. A token may be shown as Active, Idle, or Unused. Idle describes recent usage; it is not the same as being revoked.
Select the revoke control for the intended client and confirm Revoke this token?. On success, the token disappears from the active list. That device loses access and needs to authorize again before it can continue using the token-based connection.
Review the MCP clients section too if you want to remove every Penny connection used by an app. Removing a plugin token and disconnecting an OAuth connection are separate actions. Neither deletes the memory already saved in Penny.
Do not copy a token into a help request or AI conversation to identify it. The displayed client name and approximate last-used time are enough to describe the row. If revocation fails, report the error and check the list again; do not treat a failed action as confirmation that access has ended.