---
title: "Revoke an API key"
method: DELETE
path: "/v1/api-keys/{id}"
tags: ["API keys"]
---

# Revoke an API key

`DELETE /v1/api-keys/{id}`

## Request

- Base URL: `https://serp-agent.com`
- URL: `https://serp-agent.com/v1/api-keys/{id}`
- Auth: HTTP bearer

A key may revoke itself, but revoking the FINAL active key is refused (`cannot_revoke_last_key`) — with zero active keys the account would be locked out. Rotation order: create the new key first, then revoke the old one. Revoking an already-revoked key is idempotent (returns the same terminal state).

## Path parameters

- `id` string, required

## Response `200`

Key revoked (or already revoked).

- ApiKeyEnvelope
  - `key` ApiKey, required
    - `id` string, required
    - `name` string, nullable, required
    - `key_prefix` 'sk_sandbox_' | 'sk_live_', required
    - `last4` string, required: Last 4 characters of the raw key.
    - `mode` 'sandbox' | 'live', required
    - `created_at` string, date-time, required
    - `last_used_at` string, date-time, nullable, required
    - `expires_at` string, date-time, nullable, required: Sandbox keys expire; live keys have null.
    - `revoked_at` string, date-time, nullable, required

## Other responses

- `400`: This is the only active key. Code: `cannot_revoke_last_key`.
- `401`: Missing, malformed, unknown, revoked, or expired API key. Codes: `unauthorized`, `key_revoked`, `key_expired`.
- `404`: No such key on this account. Code: `not_found`.
- `429`: Rate limit exceeded (600 requests/minute per API key). Honor `Retry-After`.

---

[API](https://skmtc.dev/serp-agent/apis/serp-agent-api.md) · [All operations](https://skmtc.dev/serp-agent/apis/serp-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/serp-agent/apis/serp-agent-api/revisions/438a943019ac?raw)