# Revoke a Realtime app key

`POST /v1/realtime/apps/{realtime_app_id}/keys/{realtime_app_key_id}/revoke`

Revokes a key immediately and returns it with `revoked_at` set. Clients that still use the key can no longer authenticate. An already revoked key returns `409`. The app's only key cannot be revoked and returns `422`.

## Code samples

**CLI**

```sh
bird realtime apps keys revoke <realtime-app-id> <realtime-app-key-id> --yes
```

Examples: [CLI](/docs/api/reference/revoke-realtime-app-key.cli.md) · [MCP](/docs/api/reference/revoke-realtime-app-key.mcp.md) · [cURL](/docs/api/reference/revoke-realtime-app-key.curl.md)

## Example response `200`

```json
{
  "id": "rak_01krdgeqcxet5s7t44vh8rt9mg",
  "key": "d0e95a856ddc1b09d4c8",
  "secret": "862925e1991a8b6902f9"
}
```

## Path parameters

- `realtime_app_id` (string): ID of the Realtime app (`rap_` prefix), as returned when the app was created.
- `realtime_app_key_id` (string): ID of the Realtime app key (`rak_` prefix), as returned when the key was created.

## Response body

- `id` (string, required)
- `key` (string, required): The public app key clients use to connect.
- `secret` (string): The key secret, used for server-side request signing. Returned only when the key is created, and never shown again: store it securely. If lost, create a new key and revoke this one.
- `revoked_at` (nullable string, required): When the key was revoked, or `null` if still active.
- `created_at` (string, required)

## Related resources

- [Realtime](/realtime-api) (product)
- [Build your first integration](/learn/paths/integration) (course)
- [Send your first realtime event](/docs/get-started/send-your-first-realtime-event) (docs)

[Get an implementation brief](/learn/workspace?topic=realtime)