Revoke a leaked or unused API key now
Stop a key authenticating, immediately and permanently. Takes a console session, so a key cannot revoke a key, and repeating it is safe.
DELETE
/
api-keys
/
{api_key_id}
# cookies.txt holds the cookies from your signed-in console session.
curl --request DELETE "$MITHUNAI_URL/mithunai/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
--cookie cookies.txt \
--header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"
import os
from http.cookiejar import MozillaCookieJar
import requests
jar = MozillaCookieJar("cookies.txt")
jar.load()
key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
response = requests.delete(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/api-keys/{key_id}",
cookies=jar,
headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
timeout=30,
)
response.raise_for_status()
print(response.json()["revoked_at"])
// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
const response = await fetch(`/mithunai/api/v1/api-keys/${keyId}`, {
method: 'DELETE',
credentials: 'include',
headers: { 'X-CSRF-Token': csrfToken },
})
console.log((await response.json()).revoked_at)
{
"id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
"name": "CI pipeline",
"prefix": "mithunai_sk_3f2a1c9e",
"role": "normal",
"status": "revoked",
"created_at": "2026-09-20T14:03:11.482190+00:00",
"created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"expires_at": "2026-12-19T14:03:11.482190+00:00",
"revoked_at": "2026-09-24T09:12:05.640021+00:00",
"last_used_at": "2026-09-23T08:41:52.117004+00:00"
}
{ "code": "authentication_error", "message": "Authentication is required." }
{ "code": "authorization_error", "message": "API key management requires a signed-in user." }
{ "code": "not_found", "message": "The requested resource was not found." }
This endpoint takes a signed-in console session, not an API key. Send the session cookies your browser received when you signed in, plus the
X-CSRF-Token header set to the value of the csrf_token cookie. A request authenticated with an mithunai_sk_ key is refused with 403. See Managing API keys.
Revocation is:
- Immediate. The key fails authentication on the very next request. There is no cache to wait out.
- Terminal. A revoked key cannot be reactivated. To restore access, create a new key.
- Idempotent. Revoking a key that is already revoked succeeds and returns it unchanged, with its original
revoked_at.
200 with the revoked key rather than 204, so you can read revoked_at without a second request. The key stays in List API keys with status set to revoked.
A key that does not exist, a key in another organization and a malformed ID all return the same 404. You need the owner or admin role.
string
required
The key’s ID (UUID), as returned in
id.string
required
The value of your session’s
csrf_token cookie (named __Host-csrf_token when the console is
served over HTTPS without a shared cookie domain). Required on this request because it changes
state; a missing or mismatched token returns 401.Response
string
required
The key’s ID (UUID).
string
required
The key’s label.
string
required
mithunai_sk_ followed by the first 8 characters of the ID. Not a secret.string
required
owner, admin, editor, normal or dataset_operator.string
required
Always
revoked.string
required
When the key was created, ISO 8601 in UTC.
string | null
required
ID of the user who created the key.
string | null
required
When the key would have expired, or
null.string
required
When the key was revoked, ISO 8601 in UTC.
string | null
required
When the key last authenticated a request, or
null if never.# cookies.txt holds the cookies from your signed-in console session.
curl --request DELETE "$MITHUNAI_URL/mithunai/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
--cookie cookies.txt \
--header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"
import os
from http.cookiejar import MozillaCookieJar
import requests
jar = MozillaCookieJar("cookies.txt")
jar.load()
key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
response = requests.delete(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/api-keys/{key_id}",
cookies=jar,
headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
timeout=30,
)
response.raise_for_status()
print(response.json()["revoked_at"])
// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
const response = await fetch(`/mithunai/api/v1/api-keys/${keyId}`, {
method: 'DELETE',
credentials: 'include',
headers: { 'X-CSRF-Token': csrfToken },
})
console.log((await response.json()).revoked_at)
{
"id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
"name": "CI pipeline",
"prefix": "mithunai_sk_3f2a1c9e",
"role": "normal",
"status": "revoked",
"created_at": "2026-09-20T14:03:11.482190+00:00",
"created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"expires_at": "2026-12-19T14:03:11.482190+00:00",
"revoked_at": "2026-09-24T09:12:05.640021+00:00",
"last_used_at": "2026-09-23T08:41:52.117004+00:00"
}
{ "code": "authentication_error", "message": "Authentication is required." }
{ "code": "authorization_error", "message": "API key management requires a signed-in user." }
{ "code": "not_found", "message": "The requested resource was not found." }
Last modified on November 7, 2026
# cookies.txt holds the cookies from your signed-in console session.
curl --request DELETE "$MITHUNAI_URL/mithunai/api/v1/api-keys/3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b" \
--cookie cookies.txt \
--header "X-CSRF-Token: $MITHUNAI_CSRF_TOKEN"
import os
from http.cookiejar import MozillaCookieJar
import requests
jar = MozillaCookieJar("cookies.txt")
jar.load()
key_id = "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b"
response = requests.delete(
f"{os.environ['MITHUNAI_URL']}/mithunai/api/v1/api-keys/{key_id}",
cookies=jar,
headers={"X-CSRF-Token": os.environ["MITHUNAI_CSRF_TOKEN"]},
timeout=30,
)
response.raise_for_status()
print(response.json()["revoked_at"])
// Runs in a page on the MITHUNAI console's own origin, while signed in.
// csrfToken is the value of the csrf_token cookie.
const keyId = '3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b'
const response = await fetch(`/mithunai/api/v1/api-keys/${keyId}`, {
method: 'DELETE',
credentials: 'include',
headers: { 'X-CSRF-Token': csrfToken },
})
console.log((await response.json()).revoked_at)
{
"id": "3f2a1c9e-8b4d-4e6f-9a1b-2c3d4e5f6a7b",
"name": "CI pipeline",
"prefix": "mithunai_sk_3f2a1c9e",
"role": "normal",
"status": "revoked",
"created_at": "2026-09-20T14:03:11.482190+00:00",
"created_by": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"expires_at": "2026-12-19T14:03:11.482190+00:00",
"revoked_at": "2026-09-24T09:12:05.640021+00:00",
"last_used_at": "2026-09-23T08:41:52.117004+00:00"
}
{ "code": "authentication_error", "message": "Authentication is required." }
{ "code": "authorization_error", "message": "API key management requires a signed-in user." }
{ "code": "not_found", "message": "The requested resource was not found." }