---
title: "Unbind the public key from one of your agent tokens"
method: POST
path: "/api/agent/keys/revoke"
tags: ["auth", "browser-session"]
---

# Unbind the public key from one of your agent tokens

`POST /api/agent/keys/revoke`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/agent/keys/revoke`
- Auth: API key in cookie `__session`

Clerk-session only. Removes the bound key AND clears `requires_signature`, so the token keeps working with the bearer header alone. The TOKEN itself stays alive — this is key rotation or a downgrade to bearer-only, not a token revoke (that lives at /floor10/agent-console).

## Request body

- AgentKeyRevokeRequest
  - `sha256` string, required: The token whose key binding is being removed.

## Response `200`

The binding is gone.

- AgentKeyRevokeResponse
  - `ok` boolean, required
  - `sha256` string, required
  - `prefix` string, required

## Other responses

- `400`: Invalid JSON or a malformed sha256.
- `401`: Not signed in, or the token is not yours.
- `500`: KV write failed.
- `503`: Auth or KV backend unavailable.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)