curl -X DELETE https://api.liddie.io/api/v1/api-keys/<keyId> \
-H "Authorization: Bearer <dashboard JWT>"
// Dashboard-session endpoint: send the JWT as a Bearer token.
const response = await fetch('https://api.liddie.io/api/v1/api-keys/<keyId>', {
method: 'DELETE',
headers: { 'Authorization': 'Bearer <dashboard JWT>' },
});
const result = await response.json();
{"success":true}
API keys
Revoke an API key
Revoke a Liddie API key by id so it stops authenticating immediately. No MFA needed since revoking only reduces capability, and the change is instant.
DELETE
/
api
/
v1
/
api-keys
/
{keyId}
curl -X DELETE https://api.liddie.io/api/v1/api-keys/<keyId> \
-H "Authorization: Bearer <dashboard JWT>"
// Dashboard-session endpoint: send the JWT as a Bearer token.
const response = await fetch('https://api.liddie.io/api/v1/api-keys/<keyId>', {
method: 'DELETE',
headers: { 'Authorization': 'Bearer <dashboard JWT>' },
});
const result = await response.json();
{"success":true}
Kill an API key. It stops authenticating immediately.
No MFA is needed — revoking only reduces capability, so it can’t be used to escalate anything.
Rotating credentials? Mint the replacement key with Create an API key and deploy it before revoking the old one — revocation takes effect the moment the call returns.
Authorization
This endpoint is dashboard-only: a dashboard JWT with rolemerchant_admin, merchant_member (with team permission api-keys:manage) or super_admin. API-key callers are rejected with 401 {"error":"Invalid or expired token"} — the JWT guard runs first and an API key is not a session token, so the call never reaches the role check. The key is not revoked; it simply cannot authenticate a dashboard-only route. Rate limit: 10/min.
A
super_admin passes the role guard, but platform accounts carry no merchant context, so the handler
short-circuits with 400 {"ok":false,"error":{"code":"NO_MERCHANT_CONTEXT","message":"No merchant context"}}.
In practice this endpoint is for merchant accounts.curl -X DELETE https://api.liddie.io/api/v1/api-keys/<keyId> \
-H "Authorization: Bearer <dashboard JWT>"
// Dashboard-session endpoint: send the JWT as a Bearer token.
const response = await fetch('https://api.liddie.io/api/v1/api-keys/<keyId>', {
method: 'DELETE',
headers: { 'Authorization': 'Bearer <dashboard JWT>' },
});
const result = await response.json();
{"success":true}
Parameters
string
required
ID of the key to revoke (from List API keys).
Response fields
boolean
true — the key stops authenticating immediately.Errors
| Status | Body | Why |
|---|---|---|
| 400 | {"ok":false,"error":{"code":"INVALID_ID","message":"Invalid ID format"}} | keyId is not a 24-character ObjectId. Checked before the lookup, so a malformed id gives this instead of a 404. |
| 404 | API_KEY_NOT_FOUND | Unknown id, or a key belonging to another merchant — both cases return the same 404. |
See also
- List API keys: find the
keyIdof the key to revoke. - Create an API key: mint the replacement key before revoking.
- Authentication: how API-key scopes and dashboard JWT sessions differ.