---
title: "Revoke an API key"
method: DELETE
path: "/api/v1/api-keys/{id}"
tags: ["API Keys"]
---

# Revoke an API key

`DELETE /api/v1/api-keys/{id}`

## Request

- Base URL: `https://www.poster.ly`
- URL: `https://www.poster.ly/api/v1/api-keys/{id}`
- Auth: HTTP bearer

Soft-revoke a user-created posterly API key after explicit confirmation. The calling token must be a dashboard-created API key with `accounts:write`. OAuth-issued tokens, managed assistant tokens, and session-authenticated requests cannot revoke API keys. The endpoint refuses to revoke the API key currently authenticating the request.

## Path parameters

- `id` string, uuid, required

## Query parameters

- `confirm` boolean

## Request body

- DeleteApiKeyRequest
  - `confirm` true, required: Must be true after the user explicitly confirms that this API key should be revoked.

## Response `200`

API key revoked successfully, or it was already revoked.

- DeleteApiKeyResponse
  - `revoked` true, required
  - `already_revoked` boolean, required: True when the key was already revoked before this request.
  - `api_key` ApiKeyResource, required
    - `id` string, required
    - `name` string, required
    - `key_prefix` string, required
    - `scopes` ApiKeyScope[], required
    - `workspace_id` string, nullable
    - `expires_at` string, date-time, nullable
    - `created_at` string, date-time, required

## Other responses

- `400`: Validation error
- `401`: Invalid or missing API key
- `403`: Request is authenticated but not allowed
- `404`: Resource not found
- `429`: Too many requests

---

[API](https://skmtc.dev/poster/apis/posterly-api.md) · [All operations](https://skmtc.dev/poster/apis/posterly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/poster/apis/posterly-api/revisions/60be02a61f95?raw)