> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fish.audio/llms.txt
> Use this file to discover all available pages before exploring further.

# Revoke Exposed API Keys

> Revoke Fish Audio API keys that have been exposed, without signing in

If you find a Fish Audio API key somewhere it shouldn't be, such as a public repository, a log, or a support ticket, submit it here to revoke it. You don't need an account or an API key of your own: anyone holding the key can already use it, so holding it is enough to revoke it.

This endpoint is for secret scanners, partners that hold their customers' Fish Audio keys, security researchers, and key owners. If the exposed key is yours, you can also delete it from [API Keys](https://fish.audio/app/api-keys/).

> [!WARNING]
>
> Revocation is permanent. The key stops working immediately, and any service
> still using it gets `401`. A revoked key can't be restored: its owner has to
> create a new one.

## What happens

* Each submitted key that matches a Fish Audio API key is deleted.
* The key's creator gets a security email listing the revoked keys. For a team key, the team owner gets one too.
* The response is always the same empty `202`, whether or not any key matched, so this endpoint never reveals whether a key exists.

## Request

* Send up to 1,000 keys per request in `credentials`.
* `source` (who you are) and `url` (where you found the keys) are optional. Fish Audio records them to investigate the exposure; they are not included in the email to the key owner.
* Each IP address can send 60 requests per hour. Requests over the limit get `429`.

```bash theme={null}
curl -X POST https://api.fish.audio/apikey/revoke \
  -H "Content-Type: application/json" \
  -d '{
    "credentials": ["sk-fish-..."],
    "source": "your-company",
    "url": "https://github.com/example/repo/blob/main/.env"
  }'
```

A `202` with an empty body means the request was accepted.


## OpenAPI

````yaml post /apikey/revoke
openapi: 3.1.0
info:
  title: FishAudio OpenAPI
  version: '1'
servers:
  - description: Fish Audio API
    url: https://api.fish.audio
security: []
tags: []
paths:
  /apikey/revoke:
    post:
      tags:
        - OpenAPI
      summary: Revoke publicly exposed API keys
      description: |-
        Anyone holding an API key's plaintext can permanently revoke it here.
        No authentication is required; Authorization headers are ignored.
        Valid requests always return the same empty 202, whether or not any
        key matched. The creator and shared team's owner receive a security
        notice. Invalid bodies return 422; each IP is limited to 60 requests
        per hour (429). Source and URL are logged for attribution only.
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RevokeCredentials'
      responses:
        '202':
          description: Request accepted, processing continues off-line
          headers: {}
        '422':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                properties:
                  status:
                    title: Status
                    type: integer
                  message:
                    title: Message
                    type: string
                  reason:
                    anyOf:
                      - type: string
                      - type: 'null'
                    default: null
                    title: Reason
                required:
                  - status
                  - message
                type: object
        '429':
          description: >-
            The user has sent too many requests in a given amount of time ("rate
            limiting")
          headers: {}
          content:
            application/json:
              schema:
                properties:
                  status:
                    title: Status
                    type: integer
                  message:
                    title: Message
                    type: string
                  reason:
                    anyOf:
                      - type: string
                      - type: 'null'
                    default: null
                    title: Reason
                required:
                  - status
                  - message
                type: object
components:
  schemas:
    RevokeCredentials:
      properties:
        credentials:
          items:
            maxLength: 256
            type: string
          maxItems: 1000
          minItems: 1
          title: Credentials
          type: array
        source:
          anyOf:
            - maxLength: 64
              type: string
            - type: 'null'
          default: null
          title: Source
        url:
          anyOf:
            - maxLength: 2048
              type: string
            - type: 'null'
          default: null
          title: Url
      required:
        - credentials
      title: RevokeCredentials
      type: object

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.