Your API key:

All requests below will use this key. Your API key is sent directly to api.cueapi.ai and never stored by the docs site.

DELETE/v1/auth/keys/{key_id}

Revoke API Key

Soft-delete an API key. Refuses if it's the last active key on the account.

Revokes an API key. The key stops authenticating immediately — the next request using it returns 401 key_revoked. The row itself stays in the database for 30 days (soft-delete) so the audit trail and lifecycle events survive; after 30 days a cleanup job hard-deletes it.

Warning

Last-key protection. If this is your only non-revoked key, the request returns 409 last_key_protected. Mint a replacement via POST /v1/auth/keys first, then revoke.

Requires the X-Confirm-Destructive: true header. Without it, returns 400 confirmation_required — an accidental DELETE from a misfiring script won't take effect.

Request

bash

curl -X DELETE https://api.cueapi.ai/v1/auth/keys/6e8fc3a0-7a12-4f8a-b8b6-9c5e1d2a3b4c \
  -H "Authorization: Bearer cue_sk_YOUR_KEY" \
  -H "X-Confirm-Destructive: true"

Response

json

{
  "id": "6e8fc3a0-7a12-4f8a-b8b6-9c5e1d2a3b4c",
  "revoked_at": "2026-04-18T05:45:22Z"
}

Idempotency

Revoking an already-revoked key is a no-op — returns 200 with the existing revoked_at timestamp. Safe to retry from client code.

Errors

Status	Code	Cause
400	`confirmation_required`	Missing `X-Confirm-Destructive: true` header
404	`not_found`	`key_id` doesn't exist or doesn't belong to the authenticated user
409	`last_key_protected`	This is the account's only non-revoked key; would lock the user out

Post-revocation behavior

The next request using the revoked key returns 401 { "code": "key_revoked" }.
Redis auth cache is invalidated synchronously on revocation — no stale-cache window up to the 5-minute TTL.
The row remains in api_keys with revoked_at set for 30 days so GET /v1/auth/keys still shows it. It's also kept queryable so api_key_audit_log rows referring to it don't orphan.
After 30 days, a cleanup job hard-deletes the row and writes a final api_key_audit_log entry with event_type="hard_deleted".

Rotate-without-downtime pattern

POST /v1/auth/keys with a new label — capture the new plaintext.
Update every consumer (MCP host, CLI, worker, CI pipeline, scripts) to use the new key.
Wait long enough to be confident no consumer still has the old plaintext in memory.
DELETE /v1/auth/keys/{old_id} — zero downtime; old consumers get key_revoked, which is the signal to roll forward.

DELETE/v1/auth/keys/{key_id}

Try it

Replace path parameters (e.g. {cue_id}) in the URL before sending.

Enter your API key above to send requests

Previous← Rename API Key NextGet Webhook Secret →