Agent key creation survives agents with many servers, and delegated credentials recheck authority before they refresh
Creating an API key for an agent that fronts a lot of MCP servers no longer times out: permission discovery for every server the agent can reach happens in one request instead of one per server. Delegated credentials also stop trusting a stale picture of who authorized them. Authorization is rechecked live before a refresh, a rotated credential is quarantined rather than replayed when identity verification is unavailable, and a federated retry is refused outright when the trusted issuer URL has changed, even if the issuer and client ids look the same.Bug fixes
- Agent key dialogs stop timing out on large agents #6742 - Delegable API key permissions load for all of an agent's MCP servers in one request instead of one per server, so the create API key dialog no longer fails with lock timeouts on agents with many servers. (Author: @adaam2)
- Delegated refreshes recheck authority first #6696 - Live authorization is rechecked before a delegated credential refresh, claim cleanup is scoped to its own issuer, and a rotated credential is quarantined rather than replayed when identity verification is unavailable. Terminal configuration secrets are cleared, while retryable provider dependency failures are preserved. (Author: @danielkov)
- Federated retries refused when the issuer URL moves #6697 - A federated delegation retry is rejected when the trusted issuer URL has changed, even if the issuer and client ids are unchanged. Private endpoint authority is revalidated before consent actions consume retry state or access credentials, and consent state is preserved when authority has been revoked or repointed. (Author: @danielkov)
- Agent creation races project deletion no longer #6695 - Project-bound agent creation is serialized with project deletion. A project with no visible agents shows the agent creation empty state, and settings headings line up with the controls they describe. (Author: @danielkov)
