Skip to main content
DELETE
Revoke API Key

Overview

Revokes an API key by setting its revoked_at timestamp. The key record is preserved so audit logs and historical usage records remain valid. Once revoked, requests using the key return 401 unauthorized immediately. System keys cannot be revoked. Requires the api-keys:manage scope and an Idempotency-Key header; see Idempotency.

Path Parameters

id
string
required
API key ID (key_...).

Response

id
string
Echo of the revoked API key ID.
object
string
Always api_key.
deleted
boolean
Always true on success.
request_id
string
Unique request identifier for support and debugging.

Code Examples

Revocation is irreversible. To roll a key without downtime, use Rotate API Key: the old key remains valid for a 24-hour grace period.

Errors