Revoke an API key

DELETE

/api-keys/{id}

Permanently revokes an API key, immediately preventing it from being used for authentication. Revocation is irreversible — a revoked key cannot be reactivated. If you need a new key for the same purpose, create a new one. The identity that makes this request is recorded as the revoked_by actor. Attempting to revoke an already-revoked key returns a 400 validation error.

Request

Authorization

JWT Bearer

Add the parameter

Authorization

to Headers

Example:

Authorization: ********************

Path Params

Responses

🟢200

application/json

API key successfully revoked. The key is now permanently disabled.

Bodyapplication/json

🟠400

🟠401

🟠403

🟠404

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE '/api-keys/01J5X8PMKW3RNVBQE2D7F9GHAT' \
--header 'Authorization: Bearer <token>'

Response Example

200 - Success

{
    "message": "API key revoked successfully",
    "status": "success",
    "data": {
        "id": "01J5X8PMKW3RNVBQE2D7F9GHAT",
        "name": "Production Server Key",
        "status": "revoked",
        "revoked_at": 1754565120000,
        "revoked_by": "01J5X8PMKW3RNVBQE2D7F9GHBT"
    }
}

Modified at 2026-09-30 00:29:30

Retrieve an API key

Rotate an API key's secret