---
title: "Revoke a live IC Key"
method: POST
path: "/api/credits/admin/revoke"
tags: ["keys"]
---

# Revoke a live IC Key

`POST /api/credits/admin/revoke`

## Request

- Base URL: `https://www.immersivecommons.com`
- URL: `https://www.immersivecommons.com/api/credits/admin/revoke`
- Auth: one of:
  - API key in cookie `__session`
  - HTTP bearer

Clerk operator session OR an agt_ token carrying `admin:llm_keys`, live tier re-checked. Sets revoked_at on the token record, so the gateway 401s the key from its next call; the member can request again (or regenerate is no longer possible on a revoked key, they request anew). Idempotent: a repeat answers `already_revoked: true`. Audited.

## Request body

- CreditsRevokeRequest
  - `token_sha256` string, required: The key to revoke, by sha256.
  - `reason` string: Free text for the audit trail.

## Response `200`

The revoked key's prefix.

- CreditsRevokeResponse
  - `ok` boolean, required
  - `token_prefix` string, required
  - `already_revoked` boolean, required: True when the key was already revoked (idempotent repeat).

## Other responses

- `400`: Invalid JSON or a malformed token_sha256.
- `401`: No auth.
- `403`: Not an operator / scope not authorized.
- `404`: No such key.

---

[API](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api.md) · [All operations](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/immersivecommons/apis/immersive-commons-agent-rest-api/revisions/be67c1f67c27?raw)