Skip to main content
Revoke a credential when its workload is retired or its value is exposed. You must be its creator or an organization admin to use the page’s Revoke action. Revocation ends the service identity’s credentials; the entry remains in the list for review.
Revocation is terminal. Workloads using this identity need a new credential and workspace grants before they can resume. Use rotation when you intend to replace the credential for the same workload.
  1. Open Settings → Developer → API keys.
  2. Identify the credential by its name and client ID. Review its workspace grants so you know which workloads may be affected.
  3. Open its action menu, select Revoke, and review the confirmation.
  4. Confirm, then use the Revoked status filter to check the result.
Remove the old value from the workload’s secret store. If it was exposed, review its available last-used information and the audit log. A missing last-used value can mean usage is unknown; it does not prove the key was never used.