---
title: "Revoke the sign-in key this request is made with (sign out)."
method: DELETE
path: "/device/credential"
tags: ["Discovery"]
---

# Revoke the sign-in key this request is made with (sign out).

`DELETE /device/credential`

## Request

- Base URL: `https://docs.sleeperhit.studio/api/v1`
- URL: `https://docs.sleeperhit.studio/api/v1/device/credential`
- Auth: HTTP bearer

The key in the Authorization header revokes ITSELF: `sleeperhit logout`, the MCP `logout` tool, and every new sign-in (which revokes the key the previous one saved) call this, so signing out ends the key on the server rather than only deleting it from one machine. Needs no scope, so a narrowed sign-in key can still end itself. Only a key minted by a browser sign-in (the device flow) can: a key made on the API page answers 409 `not_a_sign_in_key` and keeps working, and an OAuth connector is disconnected from the API page instead. A key that is already revoked or expired answers 401. The key gives up any standing approval it held, as a revoke from the API page does. Uses the common error envelope. Free.

## Response `200`

The key is revoked.

- object
  - `revoked` true, required
  - `keyPrefix` string, nullable: The revoked key's display prefix.

## Other responses

- `401`: Missing, malformed, revoked, or expired API key.
- `403`: API key is valid but lacks the scope, is blocked by IP allowlist, or the account is disabled.
- `409`: `not_a_sign_in_key` — the credential was not minted by a browser sign-in; nothing was revoked.
- `429`: Rate limit for this API key + IP + route family was exceeded.
- `500`: The API failed unexpectedly. Safe to retry with the same Idempotency-Key.

---

[API](https://skmtc.dev/sleeperhit/apis/sleeper-hit-studio-story-api.md) · [All operations](https://skmtc.dev/sleeperhit/apis/sleeper-hit-studio-story-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sleeperhit/apis/sleeper-hit-studio-story-api/revisions/64c1102ccb2f?raw)