---
title: "Revoke an API key"
method: POST
path: "/revokeAgentApiKey"
tags: ["Agent Wallet"]
---

# Revoke an API key

`POST /revokeAgentApiKey`

## Request

- Base URL: `https://laso.finance`
- URL: `https://laso.finance/revokeAgentApiKey`
- Auth: API key in header `Authorization`

Revokes one `lasoak_` API key, the same action as Revoke on the dashboard. A revoked key can no longer be exchanged for a session at `agentAuth`, and its MCP event subscriptions stop. A session already minted from the key is not cut off: its `id_token` lasts out its hour. Revoking a key that is already revoked succeeds and changes nothing.

To revoke a key you hold the raw value of, you can instead POST it as `token` to `/oauth/revoke` (RFC 7009) without looking up its `keyId`.

A Firebase callable. Callables wrap the request in `{"data": ...}` and the reply in `{"result": ...}`. Send the `id_token` from `/auth` as a Bearer token. Free.

## Request body

- object
  - `data` object, required
    - `userId` string, required: The Laso user id (the `usr_...` value from /auth).
    - `keyId` string, required: The key's id, as returned by `createAgentApiKey` or `listAgentApiKeys`.

## Response `200`

The key is revoked. Nothing is returned.

- object
  - `result` object

## Other responses

- `400`: A required field is missing or invalid.
- `401`: Missing, invalid, or expired Bearer token.
- `404`: No API key with that `keyId` on the account.

---

[API](https://skmtc.dev/laso/apis/laso-finance-x402-api.md) · [All operations](https://skmtc.dev/laso/apis/laso-finance-x402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/laso/apis/laso-finance-x402-api/revisions/ff8ce20b49ba?raw)