Revoke an API key

Requires a browser session. Do not send Authorization. Cookie writes need Origin or Referer to be WEB_ORIGIN or PUBLIC_BASE_URL. A missing or different origin is 403 FORBIDDEN. Another user’s key id is 404. After delete, that key fails closed on product routes.

POST /api/auth/api-key/delete

200

{
  "success": true
}

Authorizations

better-auth.session_token · string · cookie · required

Better Auth session cookie from email/password sign-in. On an https API origin the name is __Secure-better-auth.session_token. On http it is better-auth.session_token. Host-only unless AUTH_COOKIE_DOMAIN is set. Use a cookie jar instead of typing the name.

Body

application/json

The key id to delete.

keyId · string · required

Minimum string length: 1

Response

200

application/json

The key was deleted.

success · boolean · required

{key} · any