---
title: "Revoke an API key"
method: DELETE
path: "/v1/auth/keys/{id}"
tags: ["Auth"]
---

# Revoke an API key

`DELETE /v1/auth/keys/{id}`

## Request

- Base URL: `https://api.zindex.ai`
- URL: `https://api.zindex.ai/v1/auth/keys/{id}`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Revokes one of your API keys at once, in whichever of your workspaces it acts. Requests that send it then answer 401 with code API_KEY_REVOKED. Revoking frees a place under the plan's apiKeys limit.

## Path parameters

- `id` string, required

## Response `200`

Revoked

- object
  - `ok` true, required

## Other responses

- `401`: Missing or invalid API key. Response includes a `code` field that distinguishes the failure mode so clients (dashboard, MCP server) can render actionable copy: `AUTH_REQUIRED` (no key or session was sent), `API_KEY_INVALID` (key not found), `API_KEY_REVOKED` (key was revoked, or its person is no longer in its workspace), `API_KEY_EXPIRED` (key passed its expires_at), and for the site's session cookie `SESSION_EXPIRED` (past its 24 hours), `SESSION_REVOKED` (the account's sessions were ended, for example by a password reset) and `SESSION_INVALID` (not a session this server signed).
- `404`: No such key of yours, or it is already revoked
- `429`: RATE_LIMITED: over the request rate limit (see Rate Limiting). Wait retryAfter seconds (also the Retry-After header), then try again.

---

[API](https://skmtc.dev/zindex/apis/zindex-api.md) · [All operations](https://skmtc.dev/zindex/apis/zindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/zindex/apis/zindex-api/revisions/1d21bd5bbf8e?raw)