Skip to main content
POST
Revoke an API key (terminal)

Authorizations

Authorization
string
header
required

Clerk dashboard session JWT. Used on dashboard, billing, playground, and admin console routes only:

These are human-session credentials, not API keys. The dashboard frontend must never send authoritative account IDs, plan values, quota counters, Stripe IDs, or API-key actor fields — the server derives ownership from the session. Admin console routes additionally require the custom admin_role claim (admin or support) on the same verified session JWT; writes require admin.

Path Parameters

id
string
required

Response

Revoked key metadata.

id
string
required
name
string
required
environment
enum<string>
required
Available options:
live,
test,
dev
scopes
enum<string>[]
required
Available options:
analyze,
bulk,
webhooks
status
enum<string>
required

No separate "expired" status. Expiration is derived from expires_at; a key past expires_at is treated as expired by verification.

Available options:
active,
revoked
preview
string
required

Non-secret suffix preview of the key (ellipsis + last 4 chars of the secret).

created_at
string<date-time>
required

RFC 3339 timestamp (UTC).

last_used_at
string<date-time> | null
required
expires_at
string<date-time> | null
required
revoked_at
string<date-time> | null
required
rotated_from_key_id
string | null