Ask for an invitation
Menu

Endpoint

Revoke an API key

DELETE/v1/keys/{id}

Immediate and permanent. A key may revoke itself.

Scope a restricted key needs
keys:write
Publishable key
Not allowed: secret or restricted key only
Idempotency-Key
Not used. A DELETE is already safe to repeat.

Parameters

Parameters of Revoke an API key
ParameterType and placeMeaning
idrequiredstringpathThe id of the key.
Orrerie-VersionstringheaderAPI version date. Default: the version the key was created with. Example 2026-10-11.

Example request

curl

curl -X DELETE https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v \
  -H "Authorization: Bearer $ORRERIE_SECRET_KEY"

JavaScript

const response = await fetch("https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v", {
  method: "DELETE",
  headers: {
    Authorization: `Bearer ${process.env.ORRERIE_SECRET_KEY}`,
  },
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.error.code}: ${result.error.message}`);
console.log(result);

Python

import os
import requests

response = requests.delete(
    "https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v",
    headers={"Authorization": f"Bearer {os.environ['ORRERIE_SECRET_KEY']}"},
    timeout=30,
)
result = response.json()
if not response.ok:
    raise RuntimeError(f"{result['error']['code']}: {result['error']['message']}")
print(result)

PHP

<?php
$request = curl_init('https://api.orrerie.com/v1/keys/key_6e3gg2c6ea176xxdek2nar6v');
curl_setopt_array($request, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'DELETE',
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . getenv('ORRERIE_SECRET_KEY'),
    ],
]);
$body = curl_exec($request);
if ($body === false) {
    throw new RuntimeException(curl_error($request));
}
$result = json_decode($body, true);
if (curl_getinfo($request, CURLINFO_HTTP_CODE) >= 400) {
    throw new RuntimeException($result['error']['code'] . ': ' . $result['error']['message']);
}
print_r($result);

Responses

200 OK

The answer is the api_key object. Headers: Orrerie-Request-Id.

Example response, 200

{
  "id": "key_6e3gg2c6ea176xxdek2nar6v",
  "object": "api_key",
  "livemode": true,
  "created": "2026-09-03T09:50:00.000Z",
  "name": "Shop backend",
  "type": "restricted",
  "prefix": "sk_live_",
  "last4": "x9Tq",
  "scopes": [
    "checkout_sessions:write",
    "orders:read",
    "refunds:write",
    "events:read"
  ],
  "allowed_ips": [],
  "status": "revoked",
  "api_version": "2026-10-11",
  "created_by": {
    "type": "member",
    "id": "mem_ceh1wpzdrpk13cnpcjy9w0fa"
  },
  "last_used_at": "2026-10-12T09:30:00.000Z",
  "expires_at": null,
  "rolled_from": null
}

Any other status: an error

A status of 400 or above answers with the error object. Branch on its code, never on its message.

Errors

This call has no error of its own. It answers with the errors every call can answer with: a bad key, a missing scope, an object that does not exist, the rate limit. Every error code has its own entry.