Revoke API Key

August 3, 2026 ยท View on GitHub

Use case

Revokes a server-to-server API key so it can no longer call protected routes.

Authentication

Dashboard protected. Send Authorization: Bearer <jwt_token>. In sandbox, also send x-feature: decision-engine.

For local development, start with:

export BASE_URL=http://localhost:8080
export AUTH_HEADER="Authorization: Bearer <jwt_token>"
# Sandbox only:
# export BASE_URL=https://sandbox.hyperswitch.io
# export FEATURE_HEADER="x-feature: decision-engine"

Request

  • Method and path: DELETE /api-key/{key_id}
  • Parameters:
    • key_id (path, required, string)
  • Body: Path parameter key_id identifies the key to revoke.

Example

Revoke key

curl --location "$BASE_URL/api-key/key_123" \
  --header "$AUTH_HEADER" \
  --request DELETE

Response

{
  "key_id": "018f2c1a-...",
  "message": "API key revoked successfully"
}

Notes

  • Existing requests using the revoked key should receive authorization failures after revocation propagates.
  • Dashboard JWT sessions are not affected.