---
title: "Revoke an app password"
method: DELETE
path: "/api/mailboxes/{id}/app-passwords/{passwordId}"
tags: ["Mailboxes"]
---

# Revoke an app password

`DELETE /api/mailboxes/{id}/app-passwords/{passwordId}`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/mailboxes/{id}/app-passwords/{passwordId}`
- Auth: one of:
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `mailboxes:write`)

Revoke one app password. Any mail client still configured with it stops authenticating immediately — there is no grace period — and the mailbox and its messages are untouched.

Requires an admin of the project. An API key is refused with 401.

Requires the `mailboxes:write` scope — Create and delete mailboxes on your verified domains.

## Path parameters

- `id` string, uuid, required
- `passwordId` string, uuid, required

## Response `200`

App password revoked

- object
  - `data` object, required
    - `revoked` true, required
  - `success` true, required

## Other responses

- `400`: Validation error
- `401`: Unauthorized — missing or invalid auth
- `403`: Forbidden — insufficient permissions or project disabled
- `404`: Resource not found
- `429`: Rate limit or billing limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)