opschain tokens revoke
Included from Basic tier
opschain tokens revoke <id>
Revokes one of your API keys or sessions by id — opschain tokens list names both kinds. The command classifies the id against your own
credential inventory and routes it to the matching v2 verb:
AuthService.RevokeAPIKey for an API key, AuthService.RevokeSession for
a session (so a
session id answered a misleading not_found). Revocation is immediate and
estate-wide: the credential stops authenticating on the next request. An
id naming neither of your credentials — unknown, or another user's — is an
honest refusal naming tokens list, so an id probe learns nothing;
revoking any user's sessions is the admin lane (opschain admin sessions revoke, opschain docs identity).
A stored login is required: without one the command fails with
you are not logged in to <server> — run 'opschain login' first (exit 2).
A server target is required the usual way (--server <url>,
OPSCHAIN_SERVER or the active context).
In the GUI, Revoke on a row of Preferences → Api keys (profile menu) revokes one of your API keys the same way.
The command takes no flags beyond the globals.
Output
revoked api key 0199c7…
revoked session 0199c8…
--quiet suppresses it.
Exit codes
| Code | Meaning |
|---|---|
| 0 | Credential revoked. |
| 1 | The id names none of your credentials, or the request failed. |
| 2 | Usage error (no server target, not logged in, no id argument). |
Examples
opschain tokens list
opschain tokens revoke 0199c7…
See also
opschain docs cli/tokens-list— finding the id to revoke.opschain docs cli/tokens-create— minting a replacement.