> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zode.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke an API key

> Revoke an API token.

Owners and admins may revoke any token of the org; billing and
member roles only their own. From then on the token gets the same 401 as an
unknown one. An unknown, already revoked or other org's token is 404.



## OpenAPI

````yaml /api-reference/openapi.yaml delete /v1/tokens/{id}
openapi: 3.1.0
info:
  title: Zode API
  version: 0.1.0
  description: Sandboxes for coding agents. Every route takes an API key as a bearer token.
servers:
  - url: https://api.zode.dev
security:
  - bearerAuth: []
tags:
  - name: Sandboxes
  - name: Commands
  - name: Browser and desktop
  - name: Snapshots
  - name: Images
  - name: Environments
  - name: Flight recorder
  - name: Attestation
  - name: Agents
  - name: Proxying
  - name: Webhooks
  - name: OpenTelemetry
  - name: Alerts
  - name: CI
  - name: Usage and billing
  - name: Workspace
  - name: Platform
paths:
  /v1/tokens/{id}:
    parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
          pattern: ^tok_[a-z2-7]{16}$
    delete:
      tags:
        - Workspace
      summary: Revoke an API key
      description: >-
        Revoke an API token.


        Owners and admins may revoke any token of the org; billing and

        member roles only their own. From then on the token gets the same 401 as
        an

        unknown one. An unknown, already revoked or other org's token is 404.
      operationId: revokeToken
      responses:
        '200':
          description: Revoked
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenRevoked'
        '400':
          $ref: '#/components/responses/Error'
        '401':
          $ref: '#/components/responses/Error'
        '403':
          $ref: '#/components/responses/Error'
        '404':
          $ref: '#/components/responses/Error'
components:
  schemas:
    TokenRevoked:
      type: object
      required:
        - id
        - revoked
      properties:
        id:
          type: string
        revoked:
          type: boolean
          const: true
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              examples:
                - not_found
                - rate_limited
                - plan_required
              description: |
                Stable machine code; branch on it rather than on `message`.
                Deliberately not a closed enum: new codes are added over time,
                so treat an unknown code by its HTTP status. The codes in use,
                by status (a few appear under two):

                - 400: `bad_request` (malformed JSON or unknown field),
                  `invalid_request`, `bad_signature`, `confirm_required`,
                  `default_environment`, `email_not_allowed`,
                  `endpoint_required`, `invalid_code`, `invalid_email`,
                  `invalid_image`, `invalid_name`, `invalid_nonce`,
                  `invalid_state`, `invalid_token`, `not_admin`,
                  `order_mismatch`, `org_required`, `owner_cannot_leave`,
                  `password_too_long`, `password_too_short`,
                  `personal_workspace`, `same_email`, `secret_unsupported`,
                  `self`, `too_many`, `unknown_channel`,
                  `unknown_environment`, `unknown_installation`,
                  `url_not_allowed`, `use_transfer`
                - 401: `unauthorized`, `invalid_credentials`, `bad_signature`
                - 402: `plan_required` (the plan does not include it),
                  `credit_exhausted` (no credit left and no card on file)
                - 403: `forbidden` (the role may not), `token_scope`, `csrf`,
                  `cors`, `email_unverified`, `installation_not_yours`,
                  `no_user`, `not_yours`, `subscriptions_off`,
                  `wrong_account`, `wrong_password`
                - 404: `not_found`, `code_not_found`, `invalid_invite`,
                  `not_configured`, `unknown_node`, `unknown_org`,
                  `unknown_sandbox`
                - 409: `invalid_state` (wrong sandbox status),
                  `concurrency_limit` (plan's running-sandbox cap),
                  `daily_cap_reached` (workspace daily spend cap),
                  `limit_reached`, `name_taken`, `node_full`, `not_running`,
                  `browser_off`, `desktop_off`, `already_deleted`,
                  `already_linked`, `already_member`, `already_on_plan`,
                  `billing_not_open`, `checkout_required`,
                  `code_not_applicable`, `code_redeemed`, `code_taken`,
                  `endpoint_disabled`, `installation_taken`,
                  `invite_pending`, `last_method`, `no_sandbox`,
                  `not_placed`, `not_waiting`, `sandboxes_running`,
                  `sole_owner`, `too_many_keys`, `trial_unavailable`,
                  `trial_used`
                - 410: `expired`, `used`, `expired_token`, `expired_invite`,
                  `code_expired`, `code_used_up`
                - 413: `too_large`
                - 415: `unsupported_media_type`
                - 429: `rate_limited` (see the RateLimited response),
                  `too_many_viewers` (desktop viewers)
                - 500: `internal`
                - 501 (this server or host cannot do it yet):
                  `feature_unavailable`, `attach_unavailable`,
                  `exec_unavailable`, `snapshots_unavailable`,
                  `images_unavailable`, `recorder_unavailable`,
                  `attestation_unavailable`
                - 502: `node_error`, `host_unreachable`, `key_destroy_failed`,
                  `provider_error`, `github_error`, `recorder_error`
                - 503: `no_capacity`, `unhealthy`, `alerts_unavailable`,
                  `auth_unavailable`, `ci_unavailable`, `email_unavailable`,
                  `ingest_unavailable`, `secrets_unavailable`,
                  `webhook_not_ready`

                The device-flow code and token endpoints answer 400 in the
                RFC 6749/8628 shape instead (OAuthError).
            message:
              type: string
  responses:
    Error:
      description: Error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: zode_tok_<64 hex chars>
      description: >-
        An API key (`zode_tok_...`). Create one in the console under API keys
        (https://console.zode.dev/tokens), or with `zode login`.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.