---
title: "Revoke API keys"
method: POST
path: "/api/v1/api-keys/bulk-revoke"
tags: ["API Keys"]
---

# Revoke API keys

`POST /api/v1/api-keys/bulk-revoke`

## Request

- Base URL: `https://xquik.com`
- URL: `https://xquik.com/api/v1/api-keys/bulk-revoke`
- Auth: API key in cookie `__Host-xquik_session`

Revokes up to 100 of your API keys at once & lists the IDs it revoked, newest first. IDs of other accounts' keys or unknown keys are skipped.

## Request body

- object
  - `ids` string[], required

## Response `200`

API keys revoked

- object
  - `revoked` string[], required: IDs of the revoked keys, newest first.

## Other responses

- `400`: Invalid input. A value past its maxLength gets this answer, & the message names the field & its limit. Bad input costs nothing, since it's refused before any read.
- `401`: Unauthenticated
- `403`: An API key or OAuth token called a route that needs a dashboard session. Sign in at dashboard.xquik.com/account instead.
- `429`: Too many requests right now. Each user gets 500 reads a second. Each minute allows 120 writes & 60 deletes. `x_api_rate_limited` means X limits this read for now. Neither answer costs anything. Wait for the seconds in `Retry-After`, then retry.
- `500`: Unexpected error.
- `default`: Unexpected error.

## Changes

- **2026-10-31** `2e8e935f1661`: 1 info
  - endpoint added
- **2026-10-31** `c57c57352955`: 1 breaking
  - api path removed without deprecation
- **2026-10-30** `02f0b86fb58d`: 1 breaking
  - api path removed without deprecation
- **2026-10-30** `d7a994ca1067`: 1 info
  - endpoint added
- **2026-10-30** `722bcc0a4fec`: 1 breaking
  - api path removed without deprecation

[Operation history](https://skmtc.dev/xquik-dev/apis/xquik-api/changes/api/v1/api-keys/bulk-revoke/post.md)

---

[API](https://skmtc.dev/xquik-dev/apis/xquik-api.md) - [All operations](https://skmtc.dev/xquik-dev/apis/xquik-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xquik-dev/apis/xquik-api/revisions/2e8e935f1661?raw)