Delete personal access token

Permanently revokes a personal access token (API key), immediately invalidating any API calls that use it.

Use this endpoint to decommission an API key that is no longer needed, has been compromised, or belongs to a user who is leaving the organization.

About Delete Personal Access Token

Deleting a personal access token permanently revokes the API key — any integration or script using it will receive authentication errors on its next call. Personal access tokens are scoped to the authenticated caller — only API keys belonging to the user associated with the API key making the request can be deleted; those belonging to other users cannot be managed here. Deletion is immediate with no grace period. Returns HTTP 204 on success with no response body. If an API key needs to be replaced rather than simply revoked, generate a new one via POST /authn2/v0/personal-access-token/ and update all dependent systems before deleting the old key. Key Parameters

personal_access_token_id — the UUID of the token record to revoke; obtain from GET /authn2/v0/personal-access-token/

Common Use Cases

Revoking an API key that may have been exposed or compromised

Decommissioning an API key used by a departing team member or retired integration

Cleaning up unused or expired API keys during a credential audit

Best Practices

If the API key is in active use, generate and deploy a replacement via POST /authn2/v0/personal-access-token/ before deleting the old one to avoid service interruption

Use GET /authn2/v0/personal-access-token/ to confirm the correct personal_access_token_id by matching on name or prefix before deleting — revocation is immediate and irreversible

Confirm the 204 response before notifying stakeholders that the API key has been revoked

Workflow

Call GET /authn2/v0/personal-access-token/ to identify the target token and retrieve its id

If the API key is in active use, generate and deploy a replacement first

Call DELETE /authn2/v0/personal-access-token/{personal_access_token_id}

Confirm the 204 response indicating successful revocation