Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

Revoke an API key

DELETE

/v1/api-keys/{id}

const url = 'http://localhost:8080/v1/api-keys/hc_key_1a2b3c4d5e6f7890';
const options = {method: 'DELETE', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request DELETE \
  --url http://localhost:8080/v1/api-keys/hc_key_1a2b3c4d5e6f7890 \
  --header 'Authorization: Bearer <token>'

Sets revoked_at to now. The key fails authentication on its next use. A caller may revoke the key it is using; its next request then gets 401. Dashboard sessions are not tied to API keys, so they are not affected. Writes an audit row.

Authorizations

BearerAuth

Parameters

Path Parameters

required

string

Example

hc_key_1a2b3c4d5e6f7890

Responses

200

The revoked key

application/json

object

required

string

key_prefix

required

The start of the key (type, mode and a few characters), enough to tell keys apart. Never the full key.

string

key_type

required

string

Allowed values: platform secret

livemode

required

boolean

name

required

string

tenant_id

required

string

created_at

required

string format: date-time

expires_at

When the key stops working. Also set on the old key during a rotation grace period.

string format: date-time

revoked_at

string format: date-time

last_used_at

Updated at most about once per interval, so it can lag a little.

string format: date-time

Example

{
  "id": "hc_key_1a2b3c4d5e6f7890",
  "key_prefix": "hc_secret_test_1a2b3c4d",
  "key_type": "platform"
}

404

No such key in this mode, or it is already revoked

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}