Skip to main content
DELETE
Revoke an API key

Authorizations

Authorization
string
header
required

Send Authorization: Bearer tst_live_….

Format (services/api-keys.ts): the literal prefix tst_live_ followed by 24 random bytes rendered as 32 base64url characters. Only the SHA-256 hash is stored server-side. The shape check that routes a token down the API-key path rather than the Clerk JWT path requires the tst_live_ prefix and a total length of at least 25 characters.

Keys are minted in the dashboard at /settings/team. The same header also accepts a Clerk session JWT, which is how the web app authenticates, but the JWT path is out of scope for this document.

Path Parameters

id
string
required

API key id (the id field from the list, not the key itself). Not UUID-validated by the handler.

Response

Revoked. Empty body.