Skip to main content

Revoke an API key

Revoke an API key when you no longer need it or when its secret leaks. A revoked key can't get a new access token.

Revoke a key in the interface​

  1. Go to Configure > API Keys.
  2. Find the key, and select Revoke in its row.
  3. In the Revoking API Key window, check the app name, and select Revoke API Key.

The interface confirms with the message API key successfully revoked, and the key disappears from the list.

Revoke a key with the API​

Prerequisites​

Find the appId of a key​

List the keys. The response includes revoked keys, so check that isRevoked is false for the key that you want.

curl --request GET "https://<server-fqdn>/api/v1/api-keys" \
  --header "X-Access-Token: <access-token>"

Each entry has the following shape. Copy the appId value of the key to revoke.

{
  "appName": "example-inventory-sync",
  "appId": "<app-id>",
  "scopes": [],
  "linkedUsers": ["<user-id>"],
  "createdBy": "<user-id>",
  "isRevoked": false,
  "lastAccessed": "2026-10-21T06:28:42.023Z"
}

Revoke the key​

Send a DELETE request that includes the appId.

curl --request DELETE "https://<server-fqdn>/api/v1/api-keys/<app-id>" \
  --header "X-Access-Token: <access-token>" \
  --include

A successful revocation returns the status 204 and no body.

StatusMessageMeaning
204NoneThe key is revoked.
404RefreshToken does not exist.No key has this appId.
410RefreshToken is already revoked.The key is already revoked.

The DELETE request doesn't delete the record. The product keeps it, marked as revoked, with the ID of the user who revoked it. For this reason, you can't create a new key with the name of a revoked key.