> ## Documentation Index > Fetch the complete documentation index at: https://docs.recurso.dev/llms.txt > Use this file to discover all available pages before exploring further. # Revoke API Key > Deactivate an API key. Revocation is persisted immediately and cannot be undone; a key that was recently in use may keep authenticating for up to five minutes while the verification cache expires. Revokes an API key. The key is soft-deactivated rather than deleted: the revocation is written before the `200` is returned, and the key stays in your records with its history. Authentication filters on the active flag, but the API caches keys that have already passed verification for five minutes and does not clear that cache on revoke — so a key that was used in the last few minutes may continue to authenticate on that API instance for up to five minutes after this call returns. A key that has not been used recently is rejected on its next request. A revoked key cannot be restored — [create a new key](/api-reference/developer/create-key) and rotate your integration to it instead. Find key IDs with [`GET /v1/developer/keys`](/api-reference/developer/list-keys). A key may revoke itself. Make sure the caller is not the last active key for an environment you still depend on. Only owners and admins can call this endpoint from a dashboard session; members receive `403`. API-key callers act with full tenant access. ## Path Parameters | Parameter | Type | Required | Description | | --------- | ------------- | -------- | -------------------------------------------------------------------------- | | `id` | string (uuid) | Yes | The API key's ID, as returned by list or create. Not the key value itself. | ## Example Request ```bash theme={null} curl -X DELETE https://api.recurso.dev/v1/developer/keys/7f2c1a9e-4b3d-4e6f-9a8b-0c1d2e3f4a5b \ -H "Authorization: Bearer $API_KEY" ``` ## Response ```json theme={null} { "status": "revoked" } ``` ## Errors | Status | Code | When | Fix | | ------ | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | | `400` | `validation_failed` | `id` is not a valid UUID. | Pass the key's `id` (a UUID) from the list or create response — not the key's display prefix, and not the secret key value. | | `401` | `unauthorized` | No API key or session cookie was sent. An invalid API key returns `invalid_api_key`; a key for the wrong mode (live vs test) returns `key_mode_mismatch`. | Send `Authorization: Bearer ` with a key for the right mode, or sign in to the dashboard. | | `403` | `forbidden` | The dashboard session belongs to a member, not an owner or admin. | Ask an owner or admin to revoke the key, or use an API key. | | `404` | `not_found` | No active key with that ID exists in your tenant, or it was already revoked. | Check the ID against the list endpoint; a key that is already revoked needs no further action. | | `500` | `internal_error` | The revocation could not be persisted. | Retry; if it persists, contact support. | Errors use the standard envelope — see [Errors](/api-reference/errors). ## OpenAPI ````yaml DELETE /v1/developer/keys/{id} openapi: 3.1.0 info: title: Recurso API version: 1.0.0 description: | The Recurso billing engine REST API. Authenticate by passing your API key as a bearer token: Authorization: Bearer Obtain an API key by registering a tenant via `POST /auth/register`. All authenticated endpoints live under the `/v1` prefix. Mutating endpoints support idempotency via the `Idempotency-Key` header. license: name: MIT identifier: MIT servers: - url: https://billing.example.com description: >- Example deployment — substitute the base URL of your own Recurso deployment. security: - bearerAuth: [] tags: - name: System description: Health, version, and API metadata - name: Auth description: Tenant registration - name: Plans description: Product catalog plans - name: Customers description: Customer management - name: Subscriptions description: Subscription lifecycle - name: Invoices description: Invoices, PDFs, and Indian GST e-invoicing - name: Coupons description: Discounts - name: Usage description: Metered usage events - name: Credit Notes description: Customer credits - name: Quotes description: Quote-to-invoice lifecycle - name: Webhooks description: Webhook endpoint management and event feed - name: Analytics description: Revenue analytics - name: Checkout description: Public hosted checkout for invoices - name: Payments description: Payment order creation - name: Inbound Webhooks description: Receivers for payment-gateway callbacks (Razorpay, Stripe) - name: Customer Portal description: Customer-facing portal — magic-link auth and session-scoped data - name: Developer description: API key management - name: Account description: Tenant account settings - name: Finance description: Ledger accounts, entries, reconciliation, and revenue recognition - name: Settings description: Tax (GST) and e-invoicing (IRP) configuration - name: Consents description: Consent records for RBI-compliant recurring billing - name: Referrals description: Customer referral program - name: Gifts description: Gift subscriptions - name: Mandates description: UPI Autopay mandates - name: Offline Payments description: Virtual accounts and manually recorded payments - name: Organizations description: Multi-entity organizations grouping several tenants - name: Accounting description: QuickBooks / Xero accounting integrations - name: Churn description: Churn risk scoring and alerts - name: Cancel Flows description: Configurable retention flows shown at cancellation time - name: Dunning description: Dunning analytics and multi-channel dunning campaigns paths: /v1/developer/keys/{id}: delete: tags: - Developer summary: Revoke an API key description: > Soft-deactivates the key; it cannot be restored. Authentication caches a verified key for up to five minutes, so a revoked key can keep working for that long before requests start failing with 401. Owner/admin only for dashboard sessions. operationId: revokeAPIKey parameters: - name: id in: path required: true schema: type: string format: uuid responses: '200': description: Key revoked. content: application/json: schema: type: object properties: status: type: string const: revoked '401': $ref: '#/components/responses/Unauthorized' '403': description: Requires owner or admin role. '404': $ref: '#/components/responses/NotFound' components: responses: Unauthorized: description: Missing or invalid credentials (API key or session cookie). content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: The requested resource does not exist. content: application/json: schema: $ref: '#/components/schemas/Error' schemas: Error: type: object required: - error properties: error: type: object description: Structured error detail. required: - code - message properties: code: type: string description: Stable machine-readable error code. examples: - validation_failed - unauthorized - forbidden - not_found - conflict - rate_limited - internal_error - invalid_api_key - key_mode_mismatch - over_refund - invoice_not_paid - invoice_already_paid message: type: string description: Human-readable explanation. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: API key description: >- Tenant API key obtained from `POST /auth/register` or `POST /v1/developer/keys`. ````