Revoke an API key
Revoking a key switches it off immediately and for good. Open API Keys in the Console, choose Revoke next to the key, and confirm.
When to revoke
- The key may have leaked: it was pasted in a chat, committed to a repository, put in browser code or seen in a screenshot.
- The service or environment that used it is gone.
- The person who created it is leaving the organization. Their keys stop working anyway once they are removed, so replace them first.
- You are rotating keys on a schedule. See Rotate an API key.
Revoke a key
Open API Keys
In the Console, select the key’s organization in the breadcrumb, then choose API Keys.
Find the key
Use the Name and the first characters in the Key column. Last used tells you whether anything still calls it.
Choose Revoke
A Revoke API Key dialog asks you to confirm. It warns that any service using the key will stop working right away and that this can’t be undone.
Confirm
Choose Revoke. You’ll see “API key revoked” and the key leaves the list.
There is no undo. If a running service depends on the key, create its replacement and deploy it before you revoke.
What happens to requests using the key
From that moment, requests with the key are refused with HTTP 401 and the error code revoked_api_key. Your code should not retry these; it needs a new key.
Who can revoke which keys
Owners and administrators can revoke any key in the organization. Developers can revoke the keys they created. If you try to revoke a key you’re not allowed to, the Console shows “Couldn’t revoke the key.”
You can also revoke keys in the main Syntic app under Settings → API Keys, using the delete icon on the key. It’s the same key list.
Does revoking free up a slot?
Yes. Only active keys count toward the limits of 20 per member and 100 per organization.