Delete API keys permanently from user accounts or for cleanup purposes.
Use this for user-requested key deletion, account deletion workflows, or cleaning up unused keys. Keys are immediately invalidated. Two modes: soft delete (default, preserves audit records) and permanent delete.
Important: For temporary access control, use updateKey
with enabled: false
instead of deletion.
Required Permissions
Your root key must have one of the following permissions:
api.*.delete_key
(to delete keys in any API)api.<api_id>.delete_key
(to delete keys in a specific API)Unkey uses API keys (root keys) for authentication. These keys authorize access to management operations in the API. To authenticate, include your root key in the Authorization header of each request:
Authorization: Bearer unkey_123
Root keys have specific permissions attached to them, controlling what operations they can perform. Key permissions follow a hierarchical structure with patterns like resource.resource_id.action
(e.g., apis.*.create_key
, apis.*.read_api
).
Security best practices:
Key deleted successfully. Verification fails immediately with up to 30-second edge propagation.
The response is of type object
.