> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opentype.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke an API key

> Revokes a key. It stops authenticating immediately. Requires `keys_write`.

Idempotent: revoking a revoked key returns `200` with the original `revoked_at`. A revoked key is never deleted; it stays in the list with `state: "revoked"`.



## OpenAPI

````yaml /api-reference/openapi.json delete /v1/keys/{key_id}
openapi: 3.1.0
info:
  title: OpenType API
  version: 0.1.0
  license:
    name: Apache-2.0
  description: >-
    The OpenType HTTP API: decision runs on Neon 1.1, API keys, usage, quota and
    billing. Every `/v1` route takes `Authorization: Bearer <credential>`, where
    the credential is an API key (`otsk_` followed by 64 hex characters) or a
    console session token. Amounts are integers in micro-USD (1,000,000 = 1 US
    dollar). Errors share one envelope, `{"error": {"code", "message",
    "request_id"}}`. Stripe is named only where it hosts checkout, the billing
    portal and receipts.
servers:
  - url: https://api.opentype.dev
    description: Production
  - url: https://api.opentype.dev
    description: Production
security:
  - bearer: []
  - bearer: []
tags:
  - name: runs
    description: Create, list, retrieve and stream runs.
  - name: keys
    description: Create, list, rotate and revoke API keys.
  - name: usage
    description: Usage rollups, the daily series, the ledger and quota.
  - name: billing
    description: Credit balance, checkout, the billing portal and auto-recharge.
  - name: health
    description: Public liveness and readiness checks.
  - name: router
    description: >-
      Model Router: classify a task with Neon 1.1 and pick a model from the
      benchmark catalog.
paths:
  /v1/keys/{key_id}:
    delete:
      tags:
        - keys
      summary: Revoke an API key
      description: >-
        Revokes a key. It stops authenticating immediately. Requires
        `keys_write`.


        Idempotent: revoking a revoked key returns `200` with the original
        `revoked_at`. A revoked key is never deleted; it stays in the list with
        `state: "revoked"`.
      operationId: revoke_key
      parameters:
        - name: key_id
          in: path
          description: >-
            The key's `id`: `key_` followed by 32 hex characters. Never the
            secret.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: The key, now `revoked`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/KeyResponse'
        '401':
          description: >-
            `missing_credentials` (no bearer credential) or `invalid_credential`
            (malformed, unknown or revoked).
        '403':
          description: >-
            `scope_denied`: the credential lacks `keys_write`. A session without
            an organization gets `no_active_organization`.
        '404':
          description: '`key_not_found`: no such key in your organization.'
        '503':
          description: >-
            `database_not_configured` or `database_unavailable`. Also
            `auth_not_configured` or `trust_keys_unavailable` when credentials
            cannot be verified.
      security:
        - bearer: []
        - bearer: []
components:
  schemas:
    KeyResponse:
      type: object
      description: A key without its secret.
      required:
        - id
        - name
        - principal
        - scopes
        - state
        - secret_prefix
        - created_by
        - created_at
      properties:
        id:
          type: string
        name:
          type: string
        principal:
          $ref: '#/components/schemas/KeyPrincipal'
        scopes:
          type: array
          items:
            $ref: '#/components/schemas/Scope'
        state:
          $ref: '#/components/schemas/KeyState'
        secret_prefix:
          type: string
          description: The first 13 characters of the secret (`otsk_` plus 8), for display.
        created_by:
          type: string
        created_at:
          type: string
        last_used_at:
          type:
            - string
            - 'null'
        revoked_at:
          type:
            - string
            - 'null'
    KeyPrincipal:
      oneOf:
        - type: object
          description: A human member. The value is the user identifier.
          required:
            - id
            - type
          properties:
            id:
              type: string
              description: The user's id.
            type:
              type: string
              enum:
                - user
        - type: object
          description: |-
            A machine identity owned by the organization. At most 64 characters
            of `[A-Za-z0-9_-]`; the service prefixes `svc_` when it is missing.
          required:
            - id
            - type
          properties:
            id:
              type: string
              description: An id you choose for the service account.
            type:
              type: string
              enum:
                - service_account
      description: >-
        Who a key acts as: a user, or a service account owned by the
        organization.
    Scope:
      type: string
      description: A permission a key or session holds.
      enum:
        - runs_read
        - runs_write
        - keys_read
        - keys_write
        - members_read
        - members_write
        - billing_read
        - billing_write
        - usage_read
    KeyState:
      type: string
      description: A revoked key is kept, never deleted.
      enum:
        - active
        - revoked
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      description: An API key (otsk_ + 64 hex) or a console session token.

````