---
title: "Revoke API Key (self-service)"
method: POST
path: "/v2alpha1/apiKeys:selfRevoke"
tags: ["ApiKeys"]
---

# Revoke API Key (self-service)

`POST /v2alpha1/apiKeys:selfRevoke`

Proof-of-possession variant of revocation. The `Self*` prefix on the
request/response messages disambiguates from the admin variants
(`AdminRevokeIssuedApiKey` / `AdminRevokeImportedApiKey`).

Allows an API key holder to revoke their own key. The caller must provide
the full API key secret as proof of possession. Supports issued API keys
and imported keys. JWT and macaroon tokens cannot be self-revoked (they
are stateless).

The PRIVILEGE_WITHDRAWN reason is not allowed for self-revocation
(admin-only).

```http
POST /v2alpha1/apiKeys:selfRevoke
{
  "credential": "sk_live_abc123...",
  "reason": "REVOCATION_REASON_KEY_COMPROMISE"
}
```

## Request body

- SelfRevokeApiKeyRequest — SelfRevokeApiKeyRequest allows an API key holder to revoke their own key by providing the full key secret as proof of possession.
  - `credential` string
  - `reason` 'REVOCATION_REASON_UNSPECIFIED' | 'REVOCATION_REASON_KEY_COMPROMISE' | 'REVOCATION_REASON_AFFILIATION_CHANGED' | 'REVOCATION_REASON_SUPERSEDED' | 'REVOCATION_REASON_PRIVILEGE_WITHDRAWN' — RevocationReason provides structured revocation reasons inspired by RFC 5280. Used in both admin and self-revocation flows. - REVOCATION_REASON_UNSPECIFIED: Default zero value. Use a specific reason; UNSPECIFIED is rejected by admin and self-revocation endpoints. - REVOCATION_REASON_KEY_COMPROMISE: The key was leaked or believed to be in the hands of an unauthorized party. - REVOCATION_REASON_AFFILIATION_CHANGED: The owning actor's relationship with the issuer changed (e.g., role change, departure). - REVOCATION_REASON_SUPERSEDED: A new key has replaced this one as part of a rotation. - REVOCATION_REASON_PRIVILEGE_WITHDRAWN: Admin-only. The actor's privilege to use this key was withdrawn by an operator. Self-revocation requests using this reason are rejected with InvalidArgument. Pair with `description` on the admin revoke requests to record the operator-supplied justification.

## Response `200`

A successful response.

- SelfRevokeApiKeyResponse — SelfRevokeApiKeyResponse is returned on successful self-revocation. Empty on success

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/ory/apis/ory-talos-api.md) · [All operations](https://skmtc.net/ory/apis/ory-talos-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ory/ory-talos-api/versions/faeb5ce56780/schema)