---
title: "Revoke access"
method: POST
path: "/api/internal/revoke"
tags: ["Internal"]
---

# Revoke access

`POST /api/internal/revoke`

Internal endpoint to revoke access tokens. Use with caution. Requires HKA_REVOCATION_KEY environment variable authentication. This is used for Revoker to allow security researchers to revoke compromised tokens.

## Request body

- object
  - `token` string, required
  - `submitter` string
  - `comment` string

## Response `201`

created

- object
  - `success` boolean
  - `status` string
  - `token_type` string
  - `owner_email` string, nullable
  - `key_name` string, nullable

## Other responses

- `422` — unprocessable entity

## Changes

- **2026-04-01** (v1) `2f45b18805b8` — 1 breaking, 5 info
  - removed the success response with the status `200`
  - added the new optional request property `comment`
  - added the new optional request property `submitter`
  - added the non-success response with the status `422`
  - …2 more
- **2026-01-27** (v1) `b6d6849481da` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/hackclub/apis/hackatime-api/changes/api/internal/revoke/post.md)

---

[API](https://skmtc.dev/hackclub/apis/hackatime-api.md) · [All operations](https://skmtc.dev/hackclub/apis/hackatime-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hackclub/hackatime-api/revisions/78326ea7a9a9/schema)