Endpoint
Revoke an API key
DELETE
/v1/keys/{id}Immediate and permanent. A key may revoke itself.
- Scope a restricted key needs
keys:write- Publishable key
- Not allowed: secret or restricted key only
- Idempotency-Key
- Not used. A DELETE is already safe to repeat.
Parameters
| Parameter | Type and place | Meaning |
|---|---|---|
idrequired | stringpath | The id of the key. |
Orrerie-Version | stringheader | API version date. Default: the version the key was created with. Example 2026-10-11. |
Example request
curl
curl -X DELETE https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v \
-H "Authorization: Bearer $ORRERIE_SECRET_KEY"JavaScript
const response = await fetch("https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v", {
method: "DELETE",
headers: {
Authorization: `Bearer ${process.env.ORRERIE_SECRET_KEY}`,
},
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result);Python
import os
import requests
response = requests.delete(
"https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v",
headers={"Authorization": f"Bearer {os.environ['ORRERIE_SECRET_KEY']}"},
timeout=30,
)
result = response.json()
if not response.ok:
raise RuntimeError(f"{result['error']['code']}: {result['error']['message']}")
print(result)PHP
<?php
$request = curl_init('https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v');
curl_setopt_array($request, [
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CUSTOMREQUEST => 'DELETE',
CURLOPT_HTTPHEADER => [
'Authorization: Bearer ' . getenv('ORRERIE_SECRET_KEY'),
],
]);
$body = curl_exec($request);
if ($body === false) {
throw new RuntimeException(curl_error($request));
}
$result = json_decode($body, true);
if (curl_getinfo($request, CURLINFO_HTTP_CODE) >= 400) {
throw new RuntimeException($result['error']['code'] . ': ' . $result['error']['message']);
}
print_r($result);Responses
200 OK
The answer is the api_key object. Headers: Orrerie-Request-Id.
Example response, 200
{
"id": "key_6e3gg2c6ea176xxdek2nar6v",
"object": "api_key",
"livemode": true,
"created": "2026-09-03T09:50:00.000Z",
"name": "Shop backend",
"type": "restricted",
"prefix": "sk_live_",
"last4": "x9Tq",
"scopes": [
"checkout_sessions:write",
"orders:read",
"refunds:write",
"events:read"
],
"allowed_ips": [],
"status": "revoked",
"api_version": "2026-10-11",
"created_by": {
"type": "member",
"id": "mem_ceh1wpzdrpk13cnpcjy9w0fa"
},
"last_used_at": "2026-10-12T09:30:00.000Z",
"expires_at": null,
"rolled_from": null
}Any other status: an error
A status of 400 or above answers with the error object. Branch on its code, never on its message.
Errors
This call has no error of its own. It answers with the errors every call can answer with: a bad key, a missing scope, an object that does not exist, the rate limit. Every error code has its own entry.