Revoke API keys

Revoking an API key immediately prevents it from authenticating with your APIs. Use this when a key is no longer needed, has the wrong scopes, or is suspected to be exposed.

How to revoke an API key

Link to this section

You can revoke an API key in the dashboard or via the API. Your customers can also revoke keys themselves in the self-serve portal if you have enabled self-serve API keys. See Self-serve API keys for more information.

Revoke a key on behalf of a user or organization in Kinde

Link to this section

• For a user-level key: Go to Users > [User] > API keys. Find the key and open the three dots menu > Revoke.
• For an organization-level key: Go to Organizations > [Organization] > API keys. Find the key and open the three dots menu > Revoke.

What changes after an API key is revoked?

Link to this section

Verification responses will indicate the key is not usable. Ensure your API enforces this:

// After verifying the API key with Kinde
if (!verification.is_valid || verification.status !== "active") {
  return res.status(401).json({error: "Invalid or inactive API key"});
}

Recommendations

Link to this section

• If the key was in use, create a replacement key and distribute it securely.
• Audit logs for usage of the revoked key_id.
• Consider rotating other keys if there was a broader incident.