Revoke API key
Revoke (remove) an existing API key.
address (the same wallet that originally signed the matching createApiKey). The gateway recovers the signer and rejects mismatches with HTTP 401. This endpoint does not require an X-API-Key header so the owner can still revoke a key that has been lost or compromised.
Revocation is scoped to (address, publicKey): only the account that owns the key may revoke it. A revoke for a key not registered to the caller’s account returns HTTP 404 and is a no-op — no state is changed.
Signing the request
Identical tocreateApiKey — same Arcus API Key domain, same per-environment chainId values, no verifyingContract — except the primary type is RevokeApiKey and the message does not include validUntil (revoke applies regardless of the key’s remaining lifetime).
Domain
eth_signTypedData_v4 call (ethers v6 / viem)
Legacy EIP-191 signatures (deprecated)
This endpoint previously accepted an EIP-191personal_sign signature over the canonical JSON message
Body
Ethereum address that owns the API key to revoke.
^(0x|0X)?[0-9a-fA-F]{40}$"0x742d35cc6634c0532925a3b844bc9e7595f2bd18"
Hex-encoded Ed25519 public key that identifies the API key to revoke.
64^[0-9a-fA-F]{64}$"a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
Name of the API wallet (included in the signing message, must match createAPIKey).
1 - 64"Arcus"
secp256k1 EIP-712 typed-data signature (r, s, v) over the RevokeApiKey payload (eth_signTypedData_v4), produced by the wallet that owns address — must be the same wallet that originally signed the matching createApiKey. See the POST /v1/revokeApiKey endpoint description for the exact domain, types, and message. During the migration window the deprecated legacy EIP-191 personal_sign scheme is also accepted. Requests where the recovered signer does not equal address are rejected with HTTP 401.
Response
API key revocation accepted and dispatched to the matching engine.
API key (hex string) that was revoked.
20-byte EVM address as hex: optional 0x or 0X prefix and exactly 40 hexadecimal digits. API responses normalize to lowercase a–f after 0x.
^(0x|0X)?[0-9a-fA-F]{40}$Revocation timestamp (epoch microseconds).
Account index for this API key.
0 <= x <= 9