API keys

$envless->keys->delete()

Revoke an API key permanently

php
/** @return DeletedKeyResource */
public function delete(string $id, int|float|null $timeout = null): array

Revokes a key. The effect is immediate: the next request presenting that secret gets 401. The row is soft-deleted, so the key disappears from list, returns 404 from get, and the id is never reused.

There is no undelete, and the secret was never recoverable in the first place, so ordering matters when you are replacing something that is live. Create the replacement first, deploy it everywhere, confirm lastUsedAt on the old key has stopped advancing, and only then revoke. That sequence gives you an overlap window that an in place rotate would not.

A key cannot revoke itself. Passing the id of the key making the request fails with 409 auth.self_mutation_forbidden, so any automated cleanup has to run under a different credential.

Example

php
use Envless\Envless;

$envless = new Envless();

$replacement = $envless->keys->create([
    'name' => 'ci-deploy-next',
    'scopes' => ['variables' => 'read'],
]);

echo $replacement['prefix'], PHP_EOL;

$revoked = $envless->keys->delete('0191f3c2-8a71-7c3e-9b2d-4f5a6c7d8e90');

echo $revoked['name'], PHP_EOL;

Parameters

ParameterTypeRequiredDescription
$idstringYesThe key id, ids only, no prefix and no slug form.
$timeoutint|floatNoSeconds each attempt of this call may take, the response body included, before it throws Envless\Exception\NetworkException with isTimeout() true. Overrides the client's timeout for this call, and 0 turns the limit off.

Returns

DeletedKeyResource with the id and name of the revoked key.

Worth knowing

  • The response has no deleted boolean. That shape belongs to $envless->webhooks->delete().
  • Revoking an already revoked key returns 404 key.not_found, so the call is not idempotent.
  • Emits key.deleted to any webhook endpoint subscribed to it.

Required scopes

keys:write

Underlying endpoint

DELETE /keys/{id}

Request and response schema, every error code, and a live playground.

In TypeScript

envless.keys.delete()

The same method in @goenvless/sdk, with the same request, retries and errors.