Revoke an API key (stops working immediately)
Revoke a key on the authenticated account. The key stops authenticating immediately — there is no grace period, so revoke only after the replacement is deployed. Revocation is permanent and cannot be undone; mint a new key instead. The row remains listable with `revoked_at` set, so the audit trail survives. Unmetered.
Authorization
BearerAuth Your API key, sent as Authorization: Bearer wm_.... Keys are wm_ followed by 40 hex characters. Create one with POST /register (free, no auth) or POST /keys.
In: header
Path Parameters
uuidResponse Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X DELETE "https://example.com/keys/497f6eca-6276-4993-bfeb-53cbbbba6f08"{ "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "revoked_at": "2019-08-24T14:15:22Z"}Rotate the API key you're calling with (old key invalidated immediately)
Replace the key used to authenticate **this** request with a fresh one that inherits its name, scopes and policy. The old key is revoked immediately, so the call that rotates a key is the last call that key can make. Capture the new value from this response before issuing another request — it is shown once and stored hashed. Use this for routine rotation or after a suspected leak. To retire a *different* key, use `DELETE /keys/{key_id}`. Unmetered.
Mint a new webhook signing secret
Generate a new signing secret for webhook deliveries on the authenticated account. Every webhook this API sends is signed with this secret so your receiver can verify the payload actually came from us. Rotating takes effect immediately — deliveries in flight are signed with the old secret, so accept both for a short window when rotating a live receiver. The secret is returned **once, in this response**. Unmetered.