---
title: "Revoke access"
method: POST
path: "/api/internal/revoke"
tags: ["Internal"]
---

# Revoke access

`POST /api/internal/revoke`

Internal endpoint to revoke access tokens. Use with caution. Requires HKA_REVOCATION_KEY environment variable authentication. This is used for Revoker to allow security researchers to revoke compromised tokens.

## Request body

- object
  - `token` string, required — The API key token to revoke (a regular UUID-format key or an admin "hka_" key).

## Response `201`

created

- object
  - `success` boolean
  - `status` string
  - `token_type` string — The name of the revoked key (e.g. the regular API key's name such as "Desktop" or the default "Hackatime key"; for admin keys, the admin key's name). This is the key name, not a type descriptor.
  - `owner_email` string, nullable
  - `key_name` string, nullable — Present only when revoking an admin ("hka_") key; the admin key's name.

## Other responses

- `302` — redirect on failed authentication — When the provided token does not match HKA_REVOCATION_KEY (or is missing), the controller does not return 401; it issues a 302 redirect to an external URL.
- `422` — unprocessable entity

---

[API](https://skmtc.dev/hackclub/apis/hackatime-admin-api.md) · [All operations](https://skmtc.dev/hackclub/apis/hackatime-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hackclub/hackatime-admin-api/revisions/f5a2d53cd28d/schema)