Revoke an API key
Permanently revokes a secret API key. Requests that use it then fail with 401. It can take a short time for the key to stop working everywhere.
Requires a management key.
Returns 404 if no key has this ID.
bearerAuthorizationBearer <token>Send a credential in the Authorization header: Authorization: Bearer <token>.
Each credential belongs to one environment of one workspace, so the API never takes a workspace or environment in the URL.
- Management key (
ffk_…, secret): manages flags, segments, environments, and API keys, and reads the audit log and analytics. It can also do everything an evaluation key can. - Evaluation key (
ffk_…, secret): for server SDKs. It evaluates flags, reads flag definitions for local evaluation, and sends telemetry. - Public token (
ffp_…, not secret): for browser and mobile apps. It evaluates flags through OFREP and sends telemetry. It cannot read flag definitions.
Keep secret keys on your server. A 401 response means the credential is missing or not valid. A 403 response means the credential is valid but its role cannot perform the operation.
keyId*stringThe API key ID, such as key_….
No content
curl -X DELETE 'https://api.toggld.io/api/v1/keys/string'Create an API key POST
Creates a secret API key for one environment. `environment` is required. The response includes the token. This is the only time the API returns it, so store it securely. Requires a management key. Returns `404` if the environment does not exist.
List public tokens GET
Returns the public token of every environment, including the full token. If an environment has no token yet, this request creates one. Requires a management key.