v7

latestOpenAPI 3.0.1raw.githubusercontent.com2026-08-01426118.4 KB

Internal

Revoke access

Internal endpoint to revoke access tokens. Use with caution. Requires HKA_REVOCATION_KEY environment variable authentication. This is used for Revoker to allow security researchers to revoke compromised tokens.

post/api/internal/revoke

Request body

tokenstring required

The API key token to revoke (a regular UUID-format key or an admin "hka_" key).

Example request

{
  "token": "3f8e9c2a-7b14-4d6e-9a2f-1c8b5d3e7f01"
}

Response

created

successboolean

statusstring

token_typestring

The name of the revoked key (e.g. the regular API key's name such as "Desktop" or the default "Hackatime key"; for admin keys, the admin key's name). This is the key name, not a type descriptor.

owner_emailstring nullable

key_namestring nullable

Present only when revoking an admin ("hka_") key; the admin key's name.

Example response

{
  "success": true,
  "status": "complete",
  "token_type": "Desktop",
  "owner_email": "orpheus@hackclub.com",
  "key_name": "Revoker admin key"
}