Revoke an API key

Production

DELETE

/v1/api-keys/{keyId}

Revokes (soft-deletes) an API key owned by the authenticated user. Pass pairedKeyId in the body to revoke both halves of a pair together; the two keys must be of opposite types (one public, one secret) and share the same base name. The legacy publicKeyId body field is accepted as an alias.

Auth: requires Authorization: Bearer <Supabase JWT> obtained from POST /v1/auth/verify-otp. Partner sk_*/pk_* keys are not accepted.

Request

Path Params

Body Params application/json

Examples

Responses

🟢204

Key(s) revoked.

This response does not have a body.

🟠400

🟠401

🟠404

🔴500

Request Example

Shell

JavaScript

Java

Swift

curl --location --request DELETE '/v1/api-keys/' \
--header 'Content-Type: application/json' \
--data '{
    "pairedKeyId": "00000000-0000-0000-0000-000000000000"
}'

Response Example

400 - Example 1

{
    "error": {
        "code": "string",
        "message": "string",
        "status": 0
    }
}

Modified at 2026-07-06 17:49:40

Create a user-linked API key pair

Request an email OTP