---
title: "Delete API token"
method: DELETE
path: "/v1/api-keys/{id}"
tags: ["API Tokens"]
---

# Delete API token

`DELETE /v1/api-keys/{id}`

<Note>
  This endpoint requires **Organization Admin** permissions.
</Note>

Permanently delete an API token. Works for all token types — Organization API keys, Personal Access Tokens (PATs), and MCP OAuth grants. This is the same as revoking a token in the Omni app.

Concurrent deletes are safe — the first caller receives `200` and the second receives `404` consistently. An Organization Admin can delete the token they authenticated with, which is useful for self-service rotation.

## Path parameters

- `id` string, uuid, required

## Response `200`

Token revoked successfully. The row is deleted; subsequent `GET` returns `404`.

- object
  - `message` string — Human-readable description of the outcome.
  - `success` boolean — Always `true` on a successful revocation.

## Other responses

- `400` — Bad Request. The `id` is not a UUID, or the `Authorization` header is missing/malformed. Possible error messages: - `Bad Request: id: Invalid UUID` - `Bad authorization header, must be formatted as Bearer <token>`
- `403` — Forbidden. The caller is not an organization admin.
- `404` — Not Found. No token with that id exists in the caller's organization, or another admin revoked it first. Possible error messages: - `Api key with id <id> does not exist`
- `405` — Method Not Allowed. HTTP method other than `GET`, `PUT`, or `DELETE`. Possible error messages: - `Method not allowed`
- `429` — Too Many Requests - Rate limit exceeded (60 requests/minute)

---

[API](https://skmtc.net/omni/apis/omni-api.md) · [All operations](https://skmtc.net/omni/apis/omni-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/omni/omni-api/revisions/6b02f7349d0e/schema)