---
title: "Revoke a connected app and its dedicated API key"
method: DELETE
path: "/oauth/connections/{grantId}"
tags: ["Account"]
---

# Revoke a connected app and its dedicated API key

`DELETE /oauth/connections/{grantId}`

## Request

- Base URL: `https://api.flashdata.dev/v2`
- URL: `https://api.flashdata.dev/v2/oauth/connections/{grantId}`
- Auth: API key in cookie `__Host-fd_session` and API key in header `X-CSRF-Token`

Full session, CSRF and allowed Origin required. Account ownership is enforced. Response is no-store.

## Path parameters

- `grantId` string, required

## Response `204`

Authorization revoked

## Other responses

- `401`: Authentication required or invalid
- `403`: Authenticated but not permitted, or CSRF validation failed
- `404`: Resource not found or not owned by the caller

---

[API](https://skmtc.dev/flashdata/apis/flashdata-customer-api.md) · [All operations](https://skmtc.dev/flashdata/apis/flashdata-customer-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flashdata/apis/flashdata-customer-api/revisions/109179fe9313?raw)