> ## Documentation Index > Fetch the complete documentation index at: https://docs.serval.com/llms.txt > Use this file to discover all available pages before exploring further. # Revoke Leaked Key > Revoke an API key by submitting its secret. Use this when you find a Serval API key secret somewhere it shouldn't be, such as a public repository, a log file, or a chat message. No authentication is required, so anyone who finds a leaked secret can take it out of service immediately. Serval API key secrets start with `svl_secret_` and end in a checksum, so a secret scanner can match them with the pattern `svl_secret_(pk|wk|mk)_[0-9A-Za-z]{49}`. Revoking a key stops it from creating new access tokens and ends the sessions of tokens it already created. Revocation can't be undone. To keep using the API, create a new key from the [API Settings page](https://app.serval.com/admin/settings). ## Example Request ```bash curl -X POST https://public.api.serval.com/v2/auth/revoke \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "secret=svl_secret_pk_..." ``` ## Response The response is `200 OK` with an empty body whether the secret matched a live key, a key that was already revoked, or nothing at all. The endpoint deliberately doesn't reveal whether a secret was valid. ## OpenAPI ````yaml /sections/api-reference/auth-openapi-spec.yaml post /v2/auth/revoke openapi: 3.1.0 info: title: API Spec version: 1.0.0 description: OpenAPI documentation for the API Spec servers: - url: https://public.api.serval.com description: US region (default) - url: https://public.eu1.serval.com description: EU region security: - bearerAuth: [] paths: /v2/auth/revoke: post: tags: - Auth API summary: Revoke Leaked Key description: > Revoke an API key by submitting its secret. Use this when you find a Serval API key secret somewhere it shouldn't be, such as a public repository, a log file, or a chat message. No authentication is required, so anyone who finds a leaked secret can take it out of service immediately. Serval API key secrets start with `svl_secret_` and end in a checksum, so a secret scanner can match them with the pattern `svl_secret_(pk|wk|mk)_[0-9A-Za-z]{49}`. Revoking a key stops it from creating new access tokens and ends the sessions of tokens it already created. Revocation can't be undone. To keep using the API, create a new key from the [API Settings page](https://app.serval.com/admin/settings). ## Example Request ```bash curl -X POST https://public.api.serval.com/v2/auth/revoke \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "secret=svl_secret_pk_..." ``` ## Response The response is `200 OK` with an empty body whether the secret matched a live key, a key that was already revoked, or nothing at all. The endpoint deliberately doesn't reveal whether a secret was valid. operationId: svauth.public.PublicAPIService.RevokeLeakedKey requestBody: required: true content: application/x-www-form-urlencoded: schema: type: object required: - secret properties: secret: type: string title: secret description: The API key secret to revoke. responses: '200': description: > The request was processed. If the secret matched a key, that key is now revoked. The body is empty. '400': description: > The `secret` field is missing. The body is a `connect.error` with `code: invalid_argument`. content: application/json: schema: $ref: '#/components/schemas/connect.error' '429': description: > More than 5 revoke requests per minute from one IP address. Wait for the number of seconds in the `Retry-After` header before retrying. headers: Retry-After: schema: type: integer description: Seconds to wait before retrying. content: application/json: schema: type: object properties: error: type: string enum: - slow_down error_description: type: string '503': description: > The revocation service is temporarily unavailable. The body is a `connect.error` with `code: unavailable`; retry after a short delay. content: application/json: schema: $ref: '#/components/schemas/connect.error' security: [] components: schemas: connect.error: type: object properties: code: type: string examples: - not_found enum: - canceled - unknown - invalid_argument - deadline_exceeded - not_found - already_exists - permission_denied - resource_exhausted - failed_precondition - aborted - out_of_range - unimplemented - internal - unavailable - data_loss - unauthenticated description: >- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. message: type: string description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. detail: $ref: '#/components/schemas/google.protobuf.Any' title: Connect Error additionalProperties: true description: >- Error type returned by Connect: https://connectrpc.com/docs/go/errors/#http-representation google.protobuf.Any: type: object properties: type: type: string value: type: string format: binary debug: type: object additionalProperties: true additionalProperties: true description: >- Contains an arbitrary serialized message along with a @type that describes the type of the serialized message. securitySchemes: bearerAuth: type: http scheme: bearer ````