> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xquik.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke many Xquik API keys at once in 1 request

> Revoke up to 100 Xquik API keys in 1 request & get back the IDs it revoked. Unknown IDs are skipped, so a retry is safe. Revocation is immediate & free.

**200**

```json theme={null}
{
  "revoked": [
    "43"
  ]
}
```

**400**

```json theme={null}
{
  "error": "invalid_input",
  "message": "Invalid input. Check the request body."
}
```

**401**

```json theme={null}
{
  "error": "unauthenticated",
  "message": "Authentication required. Provide a valid API key or bearer token."
}
```

**403**

```json theme={null}
{
  "error": "session_required",
  "message": "API keys & OAuth tokens cannot use this route. Sign in at dashboard.xquik.com/account instead."
}
```

**429**

```json theme={null}
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again later.",
  "retryAfter": 60
}
```

> For the complete documentation index, see [llms.txt](/llms.txt).

Clean up old or leaked keys in 1 request. Xquik revokes each listed key that belongs to your account
and answers with the IDs it revoked. It skips IDs of unknown keys and of other accounts' keys, so a
retry is safe.

**Free.** This endpoint does not consume credits.

```bash cURL theme={null}
curl -X POST https://dashboard.xquik.com/api/v1/api-keys/bulk-revoke \
  -H "Cookie: __Host-xquik_session=YOUR_SESSION_COOKIE" \
  -H "Origin: https://dashboard.xquik.com" \
  -H "Sec-Fetch-Site: same-origin" \
  -H "Content-Type: application/json" \
  -d '{"ids": ["42", "43"]}' | jq
```

```javascript Node.js theme={null}
const response = await fetch("https://dashboard.xquik.com/api/v1/api-keys/bulk-revoke", {
  method: "POST",
  headers: {
    Cookie: "__Host-xquik_session=YOUR_SESSION_COOKIE",
    Origin: "https://dashboard.xquik.com",
    "Sec-Fetch-Site": "same-origin",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ ids: ["42", "43"] }),
});
const { revoked } = await response.json();
console.log(revoked);
```

```python Python theme={null}
import requests

response = requests.post(
    "https://dashboard.xquik.com/api/v1/api-keys/bulk-revoke",
    cookies={"__Host-xquik_session": "YOUR_SESSION_COOKIE"},
    headers={"Origin": "https://dashboard.xquik.com", "Sec-Fetch-Site": "same-origin"},
    json={"ids": ["42", "43"]},
)
print(response.json()["revoked"])
```

```go Go theme={null}
package main

import (
	"bytes"
	"fmt"
	"io"
	"log"
	"net/http"
)

func main() {
	body := bytes.NewBufferString(`{"ids": ["42", "43"]}`)
	req, err := http.NewRequest("POST", "https://dashboard.xquik.com/api/v1/api-keys/bulk-revoke", body)
	if err != nil {
		log.Fatal(err)
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Origin", "https://dashboard.xquik.com")
	req.Header.Set("Sec-Fetch-Site", "same-origin")
	req.AddCookie(&http.Cookie{Name: "__Host-xquik_session", Value: "YOUR_SESSION_COOKIE"})

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		log.Fatal(err)
	}
	defer resp.Body.Close()

	answer, err := io.ReadAll(resp.Body)
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(string(answer))
}
```

## Headers

**Cookie** `string` *required*

Your signed-in dashboard session cookie, `__Host-xquik_session`. API keys and OAuth tokens get
`403 session_required`.

**Origin** `string` *required*

Must be `https://dashboard.xquik.com`, sent with `Sec-Fetch-Site` set to `same-origin`. The
dashboard sends both.

**Content-Type** `string` *required*

Must be `application/json`.

## Body

**ids** `string[]` *required*

IDs of the keys to revoke, from 1 to 100. Get them from [List API keys](/api-reference/api-keys/list.md).

## Response

### 200 OK

**revoked** `string[]`

IDs of your keys that are now revoked, newest first. A key you had already revoked still appears.
Unknown IDs and other accounts' keys never do. A repeated ID appears once.

```json theme={null}
{ "revoked": ["42", "43"] }
```

### 400 Invalid input

```json theme={null}
{
  "error": "invalid_input",
  "message": "Send ids as a list of 1 to 100 API key IDs."
}
```

`ids` was missing, empty, longer than 100, or held a value that is not a numeric ID. Xquik revokes
nothing.

### 401 Unauthenticated

```json theme={null}
{ "error": "unauthenticated" }
```

Missing, expired, or invalid dashboard session cookie.

### 429 Rate limited

```json theme={null}
{
  "error": "rate_limit_exceeded",
  "message": "Too many requests. Try again later.",
  "retryAfter": 60
}
```

Too many requests. Wait for the `Retry-After` header before retrying.

> [!WARNING]
>
> Revocation is **immediate and permanent**. Every request with a revoked key returns
> `401 Unauthenticated`. Create a new key if you need one.

> [!NOTE]
>
> API key revocation requires a same-origin dashboard session. API keys and OAuth bearer tokens cannot
> revoke account keys.
>
> **Related.** [Revoke API Key](/api-reference/api-keys/revoke.md) · [List API Keys](/api-reference/api-keys/list.md) · [Create API Key](/api-reference/api-keys/create.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.